AttestoPhoenix.ClientAuthentication.Policy (AttestoPhoenix v4.2.1)

The per-caller policy for AttestoPhoenix.ClientAuthentication.

See the parent module for the meaning of each field. Expressed as data so a caller passes its policy rather than toggling a behaviour flag inside the core.

Summary

Functions

for_endpoint(config, endpoint)

Build the client-authentication policy for an endpoint.

Types

endpoint()

@type endpoint() ::
  :token
  | :par
  | :introspection
  | :device_authorization
  | :backchannel_authentication
  | :revocation

method()

@type method() ::
  :client_secret_basic
  | :client_secret_post
  | :private_key_jwt
  | :attest_jwt_client_auth
  | :tls_client_auth
  | :self_signed_tls_client_auth
  | :none

t()

@type t() :: %AttestoPhoenix.ClientAuthentication.Policy{
  allow_cimd_clients: boolean(),
  allow_public: boolean(),
  allowed_methods: [method()],
  assertion_audiences: [String.t()],
  assertion_enforce_fapi_alg_policy: boolean() | nil,
  assertion_max_lifetime: pos_integer(),
  assertion_signing_algs: [String.t()],
  basic_precedence: boolean(),
  honor_configured_methods: boolean()
}

Functions

for_endpoint(config, endpoint)

@spec for_endpoint(AttestoPhoenix.Config.t(), endpoint()) :: t()

Build the client-authentication policy for an endpoint.

This is the authoritative endpoint matrix. The client-authentication methods themselves remain constrained by the server catalog and each client's registered method; allow_public controls whether a registered public client may use none. PAR and revocation follow the token endpoint's public-client rules. Revocation retains Basic precedence over redundant body credentials.