# `AttestoPhoenix.Callback`
[🔗](https://github.com/XukuLLC/attesto_phoenix/blob/v0.19.0/lib/attesto_phoenix/callback.ex#L1)

Invocation of configured callbacks in the forms accepted throughout the
library.

A callback supplied to `AttestoPhoenix.Config` (and to the plugs and
controllers built on it) may be expressed as a bare anonymous/captured
function, a `{module, function}` pair, or a `{module, function, extra_args}`
tuple whose trailing arguments follow the per-call arguments. This module is
the single place that resolves those forms; it carries no policy of its own.

# `callback`

```elixir
@type callback() :: function() | {module(), atom()} | {module(), atom(), [any()]}
```

# `config_callback`

```elixir
@spec config_callback(map(), atom()) :: callback() | nil
```

Read a configured callback off the config struct by `key`.

This is the single reader the controllers, plugs, and core modules share for
pulling a host callback out of `%AttestoPhoenix.Config{}` (or any struct/map
carrying it). An absent key reads as `nil`, matching the fail-closed
resolution used throughout the library; the value is otherwise returned
unchanged for an `invoke/2,3` caller to run. It carries no policy.

# `config_flag`

```elixir
@spec config_flag(map(), atom()) :: boolean()
```

Read a boolean policy flag off the config struct by `key`.

An absent or non-boolean value reads as `false` (fail closed: a flag the host
did not set never turns a control on).

# `invoke`

```elixir
@spec invoke(callback(), [any()]) :: any()
```

Invoke `callback` with `args`.

For the `{module, function, extra_args}` form the `extra_args` are appended
after `args`, matching `AttestoPhoenix.Config`'s `callback` type.

# `invoke`

```elixir
@spec invoke(callback() | nil, [any()], any()) :: any()
```

Invoke `callback` with `args`, returning `default` when `callback` is `nil`.

# `to_fun2`

```elixir
@spec to_fun2(callback()) :: (any(), any() -> any())
```

Adapt a configured `callback` (any accepted form) into a plain 2-arity
function.

A DPoP replay-check callback (`(jti, ttl_seconds) -> :ok | {:error, term}`)
is handed to `Attesto.DPoP.verify_proof/2`, which requires a literal 2-arity
function (or `nil`) and rejects a `{module, function}` / `{module, function,
extra_args}` tuple. A host cannot put an anonymous function in config, so it
configures `:replay_check` as an MFA tuple; this wraps any callback form in a
closure that routes through `invoke/2`, so the core verifier always receives
the bare function it demands. A callback that is already a function is wrapped
transparently.

---

*Consult [api-reference.md](api-reference.md) for complete listing*