Module token 

Re-exports

use std::time::Duration; 🔒

use axum::Json; 🔒

use axum::body::Body; 🔒

use axum::extract::Form; 🔒

use axum::extract::State; 🔒

use axum::response::IntoResponse; 🔒

use http::Response; 🔒

use http::StatusCode; 🔒

use http::header::CACHE_CONTROL; 🔒

use http::header::PRAGMA; 🔒

use ruma::OwnedDeviceId; 🔒

use ruma::UserId; 🔒

use serde::Deserialize; 🔒

use serde::Deserialize; 🔒

use serde_json::json; 🔒

use tuwunel_core::Err; 🔒

use tuwunel_core::Error; 🔒

use tuwunel_core::Result; 🔒

use tuwunel_core::err; 🔒

use tuwunel_core::info; 🔒

use tuwunel_core::info; 🔒

use tuwunel_core::utils::time::now; 🔒

use tuwunel_core::warn; 🔒

use tuwunel_service::Services; 🔒

use tuwunel_service::oauth::server::DeviceGrantPoll; 🔒

use tuwunel_service::oauth::server::IdTokenClaims; 🔒

use tuwunel_service::oauth::server::Server; 🔒

use tuwunel_service::oauth::server::narrow_scope; 🔒

use tuwunel_service::users::device::generate_refresh_token; 🔒

use super::oauth_error; 🔒

use super::require_account_usable; 🔒

use crate::ClientIp; 🔒

Structs

ApprovedGrant 🔒

An authenticated grant ready to mint tokens.

TokenRequest 🔒

Functions

issue_tokens 🔒

Mint the access token, refresh token and device for an authenticated grant, honoring the MSC2967 device scope and emitting the OAuth token response.

token_authorization_code 🔒

token_device_code 🔒

RFC 8628 §3.4: poll the device-code grant; pending, denied and expired map to the §3.5 error codes.

token_error_response 🔒

RFC 6749 §5.2: map error to correct HTTP status and OAuth2 error code. Client-side errors (invalid grant, bad params) → 400 invalid_grant. Server-side errors → 500 server_error with sanitized message.

token_refresh 🔒

token_refresh_response 🔒

token_route 🔒