provider/discovery.aug diagrams

OpenID Connect login application

Project overview · Compiled explanation

Class interactions

100%

Mermaid source

flowchart TD
    n0["SigningKeys"]
    n1["Crypto"]
    n2["rsaJwk"]
    n3["jwks"]
    n3 -->|"calls provider； depends on"| n0
    n3 -->|"calls publicRsa； depends on"| n1
    n3 -->|"calls"| n2

Sequences

Call arrows identify checked targets; loop and branch frames determine when they run. Open that target’s module to follow its implementation. Branches describe alternatives; loops describe repeated work. Native calls and interface dispatch stop at their declared contracts. Exit notes end that path; enclosing recovery and cleanup remain visible.

Discovery constructor

Source

Discovery advertises exactly this provider's supported authorization-code profile.

It takes issuer, authorization_endpoint, token_endpoint, userinfo_endpoint, and jwks_uri as strings, kept read-only and response_types_supported, grant_types_supported, subject_types_supported, id_token_signing_alg_values_supported, token_endpoint_auth_methods_supported, scopes_supported, claims_supported, and code_challenge_methods_supported as List<string>, kept read-only.

Receive fields: issuer, authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri, response_types_supported, grant_types_supported, subject_types_supported, id_token_signing_alg_values_supported, token_endpoint_auth_methods_supported, scopes_supported, claims_supported, code_challenge_methods_supported. Explanation.

discovery

Source

discovery handles GET /provider/.well-known/openid-configuration.

100%

Mermaid source

sequenceDiagram
    participant p0 as discovery
    participant p1 as common/settings
    Note over p0: GET /provider/.well-known/openid-configuration
    p0->>p1: settings()
    p1-->>p0: config: Settings
    p0->>p0: Discovery(issuer=config.issuer,<br/>authorization_endpoint=config.issuer + ”/authorize”,<br/>token_endpoint=config.issuer + ”/token”,<br/>userinfo_endpoint=config.issuer + ”/userinfo”,<br/>jwks_uri=config.issuer + ”/jwks”,<br/>response_types_supported=［”code”］,<br/>grant_types_supported=［”authorization_code”］,<br/>subject_types_supported=［”public”］,<br/>id_token_signing_alg_values_supported=［”RS256”］,<br/>token_endpoint_auth_methods_supported=［”none”］,<br/>scopes_supported=［”openid”, ”profile”］,<br/>claims_supported=［”iss”, ”sub”, ”aud”, ”exp”, ”iat”,<br/>”nonce”, ”name”］,<br/>code_challenge_methods_supported=［”S256”］) · construct<br/>value
    p0-->>p0: Discovery result: Discovery
    Note over p0: Return Discovery(issuer=config.issuer,<br/>authorization_endpoint=config.issuer + ”/authorize”,<br/>token_endpoint=config.issuer + ”/token”,<br/>userinfo_endpoint=config.issuer + ”/userinfo”,<br/>jwks_uri=config.issuer + ”/jwks”,<br/>response_types_supported=［”code”］,<br/>grant_types_supported=［”authorization_code”］,<br/>subject_types_supported=［”public”］,<br/>id_token_signing_alg_values_supported=［”RS256”］,<br/>token_endpoint_auth_methods_supported=［”none”］,<br/>scopes_supported=［”openid”, ”profile”］,<br/>claims_supported=［”iss”, ”sub”, ”aud”, ”exp”, ”iat”,<br/>”nonce”, ”name”］,<br/>code_challenge_methods_supported=［”S256”］)； required<br/>cleanup runs before exit
    Note over p0: HTTP result follows declared response and error mapping；<br/>unhandled request failure returns 500

jwks

Source

jwks handles GET /provider/jwks.

Only the provider's public signing key is published. Session keys never enter this JWKS.

It gets crypto (Crypto) and keys (SigningKeys) from dependency injection.

It can call SigningKeys.provider, Crypto.publicRsa, and Crypto.exportRsa.

It can also raise CryptoError and KeyError.

100%

Mermaid source

sequenceDiagram
    participant p0 as jwks
    participant p1 as keys: SigningKeys
    participant p2 as crypto: Crypto
    participant p3 as crypto/jose
    Note over p0: GET /provider/jwks
    p0->>p1: provider() · interface dispatch
    p1-->>p0: provider result: RsaPrivateKey
    p0->>p2: publicRsa(key=provider result) · interface dispatch
    p2-->>p0: publicKey: RsaPublicKey
    p0->>p3: rsaJwk(publicKey=publicKey, kid=”provider-1”)
    p3-->>p0: rsaJwk result: RsaJwk
    p0->>p0: RsaJwks(keys=［rsaJwk result］) · construct value
    p0-->>p0: RsaJwks result: RsaJwks
    Note over p0: Return RsaJwks(keys=［rsaJwk(publicKey=publicKey,<br/>kid=”provider-1”)］)； required cleanup runs before exit
    Note over p0: May leave with checked errors: CryptoError, KeyError
    Note over p0: HTTP result follows declared response and error mapping；<br/>unhandled request failure returns 500

Called contracts

• SigningKeys — common/keys.aug
• SigningKeys.provider — common/keys.aug
• settings — common/settings.aug
• Crypto — package/@git/url_9ef654c66d34ab8f5527@0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug
• Crypto.publicRsa — package/@git/url_9ef654c66d34ab8f5527@0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/contracts.aug
• RsaJwks — package/@git/url_9ef654c66d34ab8f5527@0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug
• rsaJwk — package/@git/url_9ef654c66d34ab8f5527@0.0.0-git.b14a0f9aa41f1ce58bd51133bcdc424033e40d40/jose.aug
• Discovery — provider/discovery.aug