Module server

Modules§

ApprovedDeviceGrant: The approved grant data the token endpoint consumes to issue tokens.
AuthCodeSession
AuthRequest
ClientRegistration
Data 🔒
DcrRequest
DeviceGrant: A pending RFC 8628 device authorization grant, keyed in the store by its device_code and reachable for the browser approval step through a separate user_code index.
IdTokenClaims
Server

DeviceGrantPoll: The outcome of a token-endpoint poll, mapped to the RFC 8628 §3.5 error codes by the caller.
DeviceGrantStatus

API_SCOPE_PREFIXES 🔒: MSC2967 API-scope prefixes, stable spelling first.
AUTH_REQUEST_LIFETIME
DEVICE_GRANT_INTERVAL_SECS
DEVICE_GRANT_LIFETIME
DEVICE_SCOPE_PREFIXES 🔒: MSC2967 device-scope prefixes, stable spelling first.

format_user_code: Render a stored user code for display, grouped with a single hyphen.
is_unreserved 🔒
narrow_scope: Narrow a requested scope to the granted scope (RFC 6749 §3.3): keep the tokens this server recognises and return them alongside the MSC2967 device id, when one was requested. Unrecognised tokens are dropped, or rejected when strict is set. A request carrying more than one device scope, or a device id outside the RFC 3986 unreserved set, is always rejected.