`provider/discovery.aug`

OpenID Connect login application · Source and specification

Files in this project

Code

IndentationBraces

aug

// aug-spec: "discovery.aug.md" explains this file. Read it before changes; refresh with aug spec.
import settings and SigningKeys and KeyError from common
import Crypto and RsaJwks and rsaJwk from crypto
/** Discovery advertises exactly this provider's supported authorization-code profile. */
Explanation 1Explanation 2
record Discovery(string issuer, string authorization_endpoint, string token_endpoint, string userinfo_endpoint, string jwks_uri, List<string> response_types_supported, List<string> grant_types_supported, List<string> subject_types_supported, List<string> id_token_signing_alg_values_supported, List<string> token_endpoint_auth_methods_supported, List<string> scopes_supported, List<string> claims_supported, List<string> code_challenge_methods_supported)
Explanation 1Explanation 2Explanation 3Explanation 4
endpoint GET "/provider/.well-known/openid-configuration" as discovery():
Explanation 1Explanation 2Explanation 3Explanation 4
    config = settings()
    return Discovery(
        issuer=config.issuer,
        authorization_endpoint=config.issuer + "/authorize",
        token_endpoint=config.issuer + "/token",
        userinfo_endpoint=config.issuer + "/userinfo",
        jwks_uri=config.issuer + "/jwks",
        response_types_supported=["code"],
        grant_types_supported=["authorization_code"],
        subject_types_supported=["public"],
        id_token_signing_alg_values_supported=["RS256"],
        token_endpoint_auth_methods_supported=["none"],
        scopes_supported=["openid", "profile"],
        claims_supported=["iss", "sub", "aud", "exp", "iat", "nonce", "name"],
        code_challenge_methods_supported=["S256"]
    )
/** Only the provider's public signing key is published. Session keys never enter this JWKS. */
Explanation 1Explanation 2Explanation 3Explanation 4
endpoint GET "/provider/jwks" as jwks(resolve Crypto crypto, resolve SigningKeys keys):
Explanation 1Explanation 2Explanation 3Explanation 4Explanation 5Explanation 6
    publicKey = crypto.publicRsa(key=keys.provider())
Explanation 1Explanation 2
    return RsaJwks(keys=[rsaJwk(publicKey=publicKey, kid="provider-1")])

aug

// aug-spec: "discovery.aug.md" explains this file. Read it before changes; refresh with aug spec.
import settings and SigningKeys and KeyError from common
import Crypto and RsaJwks and rsaJwk from crypto
/** Discovery advertises exactly this provider's supported authorization-code profile. */
Explanation 1Explanation 2
record Discovery(string issuer, string authorization_endpoint, string token_endpoint, string userinfo_endpoint, string jwks_uri, List<string> response_types_supported, List<string> grant_types_supported, List<string> subject_types_supported, List<string> id_token_signing_alg_values_supported, List<string> token_endpoint_auth_methods_supported, List<string> scopes_supported, List<string> claims_supported, List<string> code_challenge_methods_supported)
Explanation 1Explanation 2Explanation 3Explanation 4
endpoint GET "/provider/.well-known/openid-configuration" as discovery() {
Explanation 1Explanation 2Explanation 3Explanation 4
    config = settings()
    return Discovery(
        issuer=config.issuer,
        authorization_endpoint=config.issuer + "/authorize",
        token_endpoint=config.issuer + "/token",
        userinfo_endpoint=config.issuer + "/userinfo",
        jwks_uri=config.issuer + "/jwks",
        response_types_supported=["code"],
        grant_types_supported=["authorization_code"],
        subject_types_supported=["public"],
        id_token_signing_alg_values_supported=["RS256"],
        token_endpoint_auth_methods_supported=["none"],
        scopes_supported=["openid", "profile"],
        claims_supported=["iss", "sub", "aud", "exp", "iat", "nonce", "name"],
        code_challenge_methods_supported=["S256"]
    )
}
/** Only the provider's public signing key is published. Session keys never enter this JWKS. */
Explanation 1Explanation 2Explanation 3Explanation 4
endpoint GET "/provider/jwks" as jwks(resolve Crypto crypto, resolve SigningKeys keys) {
Explanation 1Explanation 2Explanation 3Explanation 4Explanation 5Explanation 6
    publicKey = crypto.publicRsa(key=keys.provider())
Explanation 1Explanation 2
    return RsaJwks(keys=[rsaJwk(publicKey=publicKey, kid="provider-1")])
}

Compiled specification

Interactions and sequences

Plain handler results default to HTTP 200 unless another status is declared. HttpResponse values choose their own status. Unhandled request failures return HTTP 500 and cancel the request tasks.

`Discovery` · immutable record · source

Discovery advertises exactly this provider's supported authorization-code profile. It takes issuer, authorization_endpoint, token_endpoint, userinfo_endpoint, and jwks_uri as strings, kept read-only and response_types_supported, grant_types_supported, subject_types_supported, id_token_signing_alg_values_supported, token_endpoint_auth_methods_supported, scopes_supported, claims_supported, and code_challenge_methods_supported as List<string>, kept read-only.

`discovery` · source

discovery handles GET /provider/.well-known/openid-configuration. It gets config from settings. It returns a Discovery with config.issuer, authorization_endpoint from the text {config.issuer}/authorize, token_endpoint from the text {config.issuer}/token, userinfo_endpoint from the text {config.issuer}/userinfo, jwks_uri from the text {config.issuer}/jwks, response_types_supported from a list containing "code", grant_types_supported from a list containing "authorization_code", subject_types_supported from a list containing "public", id_token_signing_alg_values_supported from a list containing "RS256", token_endpoint_auth_methods_supported from a list containing "none", scopes_supported from a list containing "openid", "profile", claims_supported from a list containing "iss", "sub", "aud", "exp", "iat", "nonce", "name", and code_challenge_methods_supported from a list containing "S256". source

Checked interface

text

discovery() returns Discovery

`jwks` · source

jwks handles GET /provider/jwks. Only the provider's public signing key is published. Session keys never enter this JWKS. It gets crypto (Crypto) and keys (SigningKeys) from dependency injection.

It can call SigningKeys.provider, Crypto.publicRsa, and Crypto.exportRsa. It can also raise CryptoError and KeyError. It sets publicKey to crypto.publicRsa with key from keys.provider. It returns a RsaJwks with keys from a list containing rsaJwk with publicKey and kid "provider-1" using injected crypto. source

Checked interface

text

jwks(resolve Crypto crypto, resolve SigningKeys keys) returns RsaJwks unless CryptoError and KeyError uses SigningKeys.provider, Crypto.publicRsa, Crypto.exportRsa

It gets crypto (Crypto) and keys (SigningKeys) from dependency injection. It can call SigningKeys.provider, Crypto.publicRsa, and Crypto.exportRsa. It can also raise CryptoError and KeyError.

Dependencies

It uses Crypto (exportRsa and publicRsa), RsaJwks, and rsaJwk from crypto. It uses KeyError, SigningKeys (provider), and settings from common. It uses Settings (issuer).

provider/discovery.aug ​

Code ​

Compiled specification ​

Discovery · immutable record · source ​

discovery · source ​

jwks · source ​

Dependencies ​