authproto 0.3.0.beta2 → 0.3.0.beta3

data/lib/authproto/state/session_manager.rb

@@ -15,72 +15,116 @@ module AuthProto
     class SessionManager
 
       # Creates a session manager and its encrypted session serializer.
+      #
+      # @param supported_signing_keys [Hash{String => String}] key IDs mapped to RFC 7638 SHA-256 thumbprints
+      # @raise [ArgumentError] if key IDs or thumbprints are not nonempty strings
       # @raise [ArgumentError] if `ATPROTO_MASTER_KEY` is not valid Base64
       #
-      def initialize
+      def initialize(supported_signing_keys: {})
+        keys = supported_signing_keys
+
+        unless keys.is_a?(Hash) && keys.all? { |id, thumb| [id, thumb].all? { |x| x.is_a?(String) && !x.empty? }}
+          raise ArgumentError, "supported_signing_keys must map nonempty key IDs to nonempty thumbprints"
+        end
+
+        @supported_signing_keys = keys.to_h { |id, thumb| [id.dup.freeze, thumb.dup.freeze] }.freeze
         @serializer = Serialization::Session.new
       end
 
       # Creates and stores a session and its state-token lookup under a storage lock.
+      # The signing key thumbprint is taken from the configured key mapping.
       #
       # @param client_id [String] OAuth client ID
       # @param scope [String] requested space-separated scopes
       # @param auth_server [Metadata::AuthorizationServer, nil] pre-resolved authorization server
       # @param did [String, nil] pre-resolved account DID
+      # @param signing_key_id [String, nil] client-authentication key ID selected before PAR
       #
       # @return [Session] newly created session
+      # @raise [ArgumentError] if the signing key ID is not configured
+      # @raise [DPoP::KeySet::KeyError] if session key generation fails
       # @raise [PKCE::Error] if session PKCE generation fails
       # @raise [Storage::StorageError] if writing or locking fails
       # @raise [Serialization::ValidationError] if the session cannot be serialized
       # @raise [Encryption::EncryptionError] if sensitive fields cannot be encrypted
       #
-      def create_session(client_id:, scope:, auth_server: nil, did: nil)
+      def create_session(client_id:, scope:, auth_server: nil, did: nil, signing_key_id: nil)
+        if signing_key_id && !@supported_signing_keys.key?(signing_key_id)
+          raise ArgumentError, "Unsupported signing_key_id: #{signing_key_id}"
+        end
+
         session = Session.new(
           client_id: client_id,
           scope: scope,
           auth_server: auth_server,
-          did: did
+          did: did,
+          signing_key_id: signing_key_id,
+          signing_key_thumbprint: @supported_signing_keys[signing_key_id],
+          authorization_expires_at: Time.now + AuthProto.configuration.pending_session_ttl
         )
 
-        # Store both session and state mapping atomically
+        # Store the session and state mapping with the same pending authorization lifetime.
         session_key = Storage::KeyBuilder.session_key(session.session_id)
         state_key = Storage::KeyBuilder.state_key(session.state_token)
 
         AuthProto.storage.with_lock(session_key, ttl: 30) do
+          ttl = session_ttl(session)
           serialized = @serializer.serialize(session)
-          AuthProto.storage.set(session_key, serialized)
-          AuthProto.storage.set(state_key, session.session_id)
+          AuthProto.storage.set(session_key, serialized, ttl: ttl)
+          AuthProto.storage.set(state_key, session.session_id, ttl: ttl)
         end
 
         session
       end
 
-      # Persists a session and updates its state-token lookup under a storage lock.
+      # Persists a session under a storage lock.
+      #
+      # Pending sessions retain their original deadline. Non-renewable authenticated sessions
+      # expire with their access token; renewable sessions have no storage expiry.
       #
       # @param session [Session] session to persist
       # @return [Session] the supplied session
       # @raise [Storage::StorageError] if writing or locking fails
       # @raise [Serialization::ValidationError] if the session cannot be serialized
       # @raise [Encryption::EncryptionError] if sensitive fields cannot be encrypted
+      # @raise [SessionError] if the pending deadline is missing or the session has expired
       #
       def update_session(session)
         session_key = Storage::KeyBuilder.session_key(session.session_id)
 
         AuthProto.storage.with_lock(session_key, ttl: 30) do
+          ttl = session_ttl(session)
           serialized = @serializer.serialize(session)
-          AuthProto.storage.set(session_key, serialized)
-
-          state_key = Storage::KeyBuilder.state_key(session.state_token)
-          AuthProto.storage.set(state_key, session.session_id)
+          AuthProto.storage.set(session_key, serialized, ttl: ttl)
         end
 
         session
       end
 
+      # Persists successful authorization without its state token and removes the callback lookup.
+      #
+      # @param session [Session] session with successfully validated and assigned tokens
+      # @return [Session] the supplied session, with its state token cleared
+      # @raise [Storage::StorageError] if writing, deletion or locking fails
+      # @raise [Serialization::ValidationError] if the session cannot be serialized
+      # @raise [Encryption::EncryptionError] if sensitive fields cannot be encrypted
+      #
+      def complete_authorization(session)
+        state_token = session.state_token
+        session.clear_state_token
+        update_session(session)
+
+        AuthProto.storage.delete(Storage::KeyBuilder.state_key(state_token)) if state_token
+
+        session
+      end
+
       # Loads and decrypts a session by ID.
       #
       # Returns `nil` for missing, unreadable or malformed sessions and for expired
-      # sessions that have no refresh token. Read/deserialization errors are logged.
+      # sessions that have no refresh token. Sessions with an unsupported signing key ID
+      # or a missing/mismatching key thumbprint are unavailable but remain in storage.
+      # Public and legacy sessions without an ID are accepted. Read/deserialization errors are logged.
       #
       # @param session_id [String] session identifier
       # @return [Session, nil] restored session, or `nil` if unavailable
@@ -98,7 +142,18 @@ module AuthProto
 
         begin
           session = @serializer.deserialize(serialized)
-          return nil if !session.renewable? && session.tokens&.expired?
+
+          if session.signing_key_id
+            thumbprint = @supported_signing_keys[session.signing_key_id]
+            return nil unless thumbprint && thumbprint == session.signing_key_thumbprint
+          end
+
+          if session.pending?
+            deadline = session.authorization_expires_at
+            return nil if !deadline || deadline <= Time.now
+          else
+            return nil if !session.tokens_valid? && !session.renewable?
+          end
 
           session
         rescue StandardError => e
@@ -111,13 +166,13 @@ module AuthProto
       #
       # Storage read errors are logged and treated as a missing session.
       #
-      # @param state [String, nil] callback state token
+      # @param state_token [String, nil] callback state token
       # @return [Session, nil] restored session, or `nil` if unavailable
       #
-      def get_session_by_state(state)
-        return nil unless state
+      def get_session_by_state_token(state_token)
+        return nil unless state_token
 
-        state_key = Storage::KeyBuilder.state_key(state)
+        state_key = Storage::KeyBuilder.state_key(state_token)
 
         begin
           session_id = AuthProto.storage.get(state_key)
@@ -127,7 +182,9 @@ module AuthProto
           return nil
         end
 
-        get_session(session_id)
+        session = get_session(session_id)
+
+        session if !session.nil? && session.state_token == state_token
       end
 
       # Deletes a session and its state mapping if it can be retrieved.
@@ -141,11 +198,9 @@ module AuthProto
         return unless session
 
         session_key = Storage::KeyBuilder.session_key(session_id)
-        state_key = Storage::KeyBuilder.state_key(session.state_token)
-
         AuthProto.storage.with_lock(session_key, ttl: 30) do
           AuthProto.storage.delete(session_key)
-          AuthProto.storage.delete(state_key)
+          AuthProto.storage.delete(Storage::KeyBuilder.state_key(session.state_token)) if session.state_token
         end
       end
 
@@ -157,6 +212,25 @@ module AuthProto
       def cleanup_expired
         # No-op - expiry handled by storage TTL and retrieval validation
       end
+
+
+      private
+
+      def session_ttl(session)
+        return nil if session.renewable?
+
+        if session.pending?
+          expires_at = session.authorization_expires_at
+          raise SessionError, "Pending session has no authorization deadline" unless expires_at
+        else
+          expires_at = session.tokens.expires_at
+        end
+
+        remaining = expires_at - Time.now
+        raise SessionError, "Session has expired" unless remaining.positive?
+
+        remaining.ceil
+      end
     end
   end
 end

data/lib/authproto/state/token_set.rb

@@ -17,10 +17,6 @@ module AuthProto
       # @return [String, nil]
       attr_reader :refresh_token
 
-      # Token scheme; always `DPoP`.
-      # @return [String]
-      attr_reader :token_type
-
       # Space-separated granted scopes.
       # @return [String]
       attr_reader :scope
@@ -36,35 +32,37 @@ module AuthProto
       # Creates a token set and calculates its expiry from the current time.
       #
       # @param access_token [String] nonempty DPoP-bound access token
-      # @param token_type [String] must be `DPoP`
-      # @param expires_in [Integer] lifetime in seconds; negative values represent expired tokens
+      # @param token_type [String] must be `DPoP` (case-insensitive)
+      # @param expires_in [Integer] lifetime of the access token in seconds; negative value means it's already expired
       # @param scope [String] nonempty space-separated granted scopes
       # @param sub [String] nonempty account DID
       # @param refresh_token [String, nil] refresh token, if issued
       # @raise [ArgumentError] if required strings are missing, the token type is wrong, or expiry is not an integer
       #
-      def initialize(
-        access_token:,
-        token_type:,
-        expires_in:,
-        scope:,
-        sub:,
-        refresh_token: nil
-      )
+      def initialize(access_token:, token_type:, expires_in:, scope:, sub:, refresh_token: nil)
         validate_token_type(token_type)
+
         validate_required('access_token', access_token)
         validate_required('scope', scope)
         validate_required('sub', sub)
+
         validate_expires_in(expires_in)
 
         @access_token = access_token
         @refresh_token = refresh_token
-        @token_type = token_type
         @scope = scope
         @sub = sub
         @expires_at = Time.now + expires_in
       end
 
+      # Returns the token scheme, which is always `DPoP`.
+      #
+      # @return [String] `DPoP`
+      #
+      def token_type
+        'DPoP'
+      end
+
       # Whether this token set includes a refresh token
       # @return [Boolean]
       def renewable?
@@ -84,7 +82,9 @@ module AuthProto
       private
 
       def validate_token_type(type)
-        raise ArgumentError, "token_type must be DPoP" unless type == 'DPoP'
+        unless type.is_a?(String) && type.casecmp?('DPoP')
+          raise ArgumentError, "token_type must be DPoP"
+        end
       end
 
       def validate_required(name, value)

data/lib/authproto/state.rb

@@ -45,7 +45,7 @@ module AuthProto
   #
   #   # Lookup session later
   #   session = manager.get_session(session.session_id)
-  #   if session.authorized?
+  #   if session.tokens_valid?
   #     puts "Access token: #{session.tokens.access_token}"
   #   end
   #

data/lib/authproto/storage/key_builder.rb

@@ -39,20 +39,12 @@ module AuthProto
 
         # Builds a namespaced storage key for a DPoP nonce.
         #
+        # @param session_id [String] OAuth session identifier
         # @param server_url [String] server origin URL
         # @return [String] colon-separated key beginning with `atproto:`
         #
-        def nonce_key(server_url)
-          build_key("nonce", server_url)
-        end
-
-        # Builds a namespaced storage key for a DPoP key.
-        #
-        # @param client_id [String] OAuth client ID
-        # @return [String] colon-separated key beginning with `atproto:`
-        #
-        def dpop_key(client_id)
-          build_key("dpop", client_id)
+        def nonce_key(session_id, server_url)
+          build_key("nonce", session_id, server_url)
         end
 
         # Builds a namespaced storage key for a lock.

data/lib/authproto/storage/memory.rb

@@ -32,7 +32,7 @@ module AuthProto
       #
       # @param key [String] nonempty key beginning with `atproto:`
       # @param value [Object] value retained by reference
-      # @param ttl [Integer, nil] positive expiry in seconds, or `nil` for no new expiry
+      # @param ttl [Integer, nil] positive expiry in seconds, or `nil` to clear any expiry
       # @return [true] if the write succeeds
       # @raise [StorageError] if key or TTL validation fails
       #
@@ -42,7 +42,13 @@ module AuthProto
 
         @monitor.synchronize do
           @data[key] = value
-          set_expiration(key, ttl) if ttl
+
+          if ttl
+            set_expiration(key, ttl)
+          else
+            @expirations.delete(key)
+          end
+
           true
         end
       end

data/lib/authproto/token/refresh.rb

@@ -7,6 +7,7 @@ require 'monitor'
 require_relative '../configuration'
 require_relative '../errors'
 require_relative '../http_client'
+require_relative '../http_helpers'
 require_relative '../par'
 require_relative '../par/client_assertion'
 require_relative '../state/token_set'
@@ -116,6 +117,7 @@ module AuthProto
     #
 
     class Refresh
+      include HTTPHelpers
       include MonitorMixin
 
       # Maximum attempts for one refresh operation.
@@ -152,9 +154,10 @@ module AuthProto
       # @param dpop_client [DPoP::Client] proof signer and nonce tracker
       # @param auth_server [Metadata::AuthorizationServer] server with a token endpoint
       # @param client_metadata [Metadata::ClientMetadata] client ID and authentication key configuration
-      # @param signing_key [Hash, JOSE::JWK, nil] private ES256 client-authentication key
+      # @param client_assertion [PAR::ClientAssertion, nil] reusable validated signer; required for confidential clients
+      # @raise [ArgumentError] if confidential-client metadata is supplied without an assertion signer
       #
-      def initialize(session:, dpop_client:, auth_server:, client_metadata:, signing_key: nil)
+      def initialize(session:, dpop_client:, auth_server:, client_metadata:, client_assertion: nil)
         super() # Initialize MonitorMixin
 
         @session = session
@@ -162,17 +165,23 @@ module AuthProto
         @auth_server = auth_server
         @attempt_count = 0
         @client_metadata = client_metadata
-        @signing_key = signing_key
+        @client_assertion = client_assertion
+
+        if client_metadata.confidential? && !client_assertion.is_a?(PAR::ClientAssertion)
+          raise ArgumentError, "Confidential clients require a client_assertion signer"
+        end
       end
 
       # Exchanges a refresh token for a replacement token set.
       #
-      # Retries eligible failures up to {MAX_RETRIES} times with exponential backoff and
-      # jitter, and handles a DPoP nonce challenge during token exchange. Does not assign
+      # Makes up to {MAX_RETRIES} attempts for eligible failures, with exponential backoff
+      # and jitter. Each attempt can retry one DPoP nonce challenge. Does not assign
       # the returned tokens to the session or persist them; the caller must do so.
+      # HTTP 400/401 OAuth errors preserve the server's error code and description in the exception message.
       #
       # @return [State::TokenSet] validated replacement tokens
       # @raise [RefreshError] if the session is not renewable, refresh fails, or retries are exhausted
+      # @raise [DPoP::Client::Error] if any response lacks a valid nonce or nonce persistence fails
       #
       def perform_refresh
         synchronize do
@@ -219,24 +228,15 @@ module AuthProto
       end
 
       def request_token_refresh
-        # Initial token request without nonce
-        response = make_token_request(session)
-
-        # Handle DPoP nonce requirement
-        if requires_dpop_nonce?(response)
-          # Extract and store nonce from error response
-          extract_dpop_nonce(response)
-          dpop_client.process_response(response[:headers], auth_server.issuer)
-
-          # Retry request with nonce
-          response = make_token_request(session)
+        response = dpop_client.with_nonce_handling(session, auth_server.token_endpoint) do
+          make_token_request(session)
         end
 
         handle_refresh_response(response)
       end
 
       def make_token_request(session)
-        dpop_proof = dpop_client.generate_proof(method: 'POST', uri: auth_server.token_endpoint)
+        dpop_proof = dpop_client.generate_proof(session: session, method: 'POST', uri: auth_server.token_endpoint)
 
         body = {
           grant_type: 'refresh_token',
@@ -257,35 +257,10 @@ module AuthProto
         )
       end
 
-      def requires_dpop_nonce?(response)
-        return false unless response[:status] == 400
-        return false if response[:body].nil?
-
-        error_data = JSON.parse(response[:body])
-        error_data.is_a?(Hash) && error_data['error'] == DPoP::ERROR_USE_NONCE
-      rescue JSON::ParserError
-        false
-      end
-
-      def extract_dpop_nonce(response)
-        nonce = (response[:headers] || {}).detect { |k, v| k.downcase == 'dpop-nonce' }&.last
-
-        unless nonce.is_a?(String) && !nonce.empty?
-          raise RefreshError.new("No DPoP nonce provided in error response", retry_possible: false)
-        end
-
-        nonce
-      end
-
       def add_client_authentication(body)
-        client_assertion = PAR::ClientAssertion.new(
-          client_id: client_metadata.client_id,
-          signing_key: @signing_key
-        )
-
         body.merge!(
           client_assertion_type: PAR::CLIENT_ASSERTION_TYPE,
-          client_assertion: client_assertion.generate_jwt(audience: auth_server.issuer)
+          client_assertion: @client_assertion.generate_jwt(audience: auth_server.issuer)
         )
       end
 
@@ -293,10 +268,8 @@ module AuthProto
         case response[:status]
         when 200
           process_successful_response(response)
-        when 400
-          handle_400_response(response)
-        when 401
-          raise RefreshError.new("Refresh token is invalid", retry_possible: false)
+        when 400, 401
+          handle_error_response(response)
         when 429
           handle_rate_limit_response(response)
         else
@@ -322,7 +295,7 @@ module AuthProto
         raise RefreshError.new("Invalid response format: #{e.message}", retry_possible: false)
       end
 
-      def handle_400_response(response)
+      def handle_error_response(response)
         raise RefreshError.new("Missing error response body", retry_possible: false) if response[:body].nil?
 
         error_data = JSON.parse(response[:body])
@@ -331,13 +304,9 @@ module AuthProto
           raise RefreshError.new("Invalid error response format", retry_possible: false)
         end
 
-        error_description = error_data['error_description'] || error_data['error']
+        error_description = [error_data['error'], error_data['error_description']].compact.join(': ')
 
         case error_data['error']
-        when DPoP::ERROR_USE_NONCE
-          extract_dpop_nonce(response)
-          dpop_client.process_response(response[:headers], auth_server.issuer)
-          raise RefreshError.new("Retry with DPoP nonce", retry_possible: true)
         when "invalid_grant"
           # The refresh token has been invalidated or already used
           raise RefreshError.new(
@@ -356,7 +325,8 @@ module AuthProto
 
       def handle_rate_limit_response(response)
         # Extract retry-after if available
-        retry_after = response[:headers]["Retry-After"]&.to_i || calculate_delay
+        retry_after = response_header(response, 'Retry-After')
+        retry_after = retry_after&.to_i || calculate_delay
         raise RefreshError, "Rate limited - retry after #{retry_after} seconds"
       end
 
@@ -365,7 +335,6 @@ module AuthProto
           raise RefreshError.new("Token response must be a JSON object", retry_possible: false)
         end
 
-        # Required fields
         %w[access_token token_type expires_in scope sub].each do |field|
           raise RefreshError.new("Missing #{field} in response", retry_possible: false) unless data[field]
         end
@@ -384,19 +353,17 @@ module AuthProto
           raise RefreshError.new("Invalid refresh_token in response", retry_possible: false)
         end
 
-        # Token type must be DPoP
-        unless data['token_type'] == 'DPoP'
+        unless data['token_type'].casecmp?('DPoP')
           raise RefreshError.new("Invalid token_type: #{data['token_type']}", retry_possible: false)
         end
 
-        # Scope must include original scopes
         original_scopes = session.scope.split
         response_scopes = data['scope'].split
+
         unless (original_scopes - response_scopes).empty?
           raise RefreshError.new("Invalid scope in response", retry_possible: false)
         end
 
-        # Subject must match
         return if data['sub'] == session.tokens.sub
 
         raise RefreshError.new("Subject mismatch in response", retry_possible: false)

data/lib/authproto/validated_uri.rb

@@ -18,11 +18,22 @@ module AuthProto
 
     attr_reader :port, :userinfo, :path
 
+    # @!attribute [r] port
+    #   Explicit port text from the input URL, or `nil` when omitted.
+    #   @return [String, nil]
+    # @!attribute [r] userinfo
+    #   User information from the input URL, including an explicitly empty component.
+    #   @return [String, nil]
+    # @!attribute [r] path
+    #   URL path, treating the root path `/` as an empty string.
+    #   @return [String]
     def_delegators :@uri, :scheme, :host, :hostname, :query, :fragment,
                    :user, :password, :registry, :opaque, :default_port,
                    :request_uri, :origin, :absolute?, :relative?, :hierarchical?,
                    :to_s, :to_str
 
+    # Parses an absolute HTTP(S) URL and preserves explicitly supplied components.
+    #
     # @param url [String, URI::Generic] URL to parse; URI inputs use their serialized form
     # @raise [URI::InvalidURIError] if the URL is malformed, not HTTP(S), or has no host
     #
@@ -42,14 +53,26 @@ module AuthProto
       @path = (@uri.path == '/') ? '' : @uri.path
     end
 
+    # Returns the explicitly supplied port, without substituting a scheme default.
+    #
+    # @return [String, nil] port text, or `nil` if omitted
+    #
     def specified_port
       port
     end
 
+    # Returns the parsed port, using the scheme default when no port was supplied.
+    #
+    # @return [Integer] effective HTTP(S) port
+    #
     def effective_port
       @uri.port
     end
 
+    # Returns the underlying parsed Ruby URI object.
+    #
+    # @return [URI::HTTP, URI::HTTPS] parsed URI; this is the original object, not a copy
+    #
     def to_uri
       @uri
     end

data/lib/authproto/version.rb

@@ -4,5 +4,5 @@ module AuthProto
 
   # Current gem version.
   # @return [String]
-  VERSION = "0.3.0.beta2"
+  VERSION = "0.3.0.beta3"
 end

data/lib/authproto.rb

@@ -5,7 +5,6 @@ require_relative 'authproto/configuration'
 require_relative 'authproto/http_client'
 require_relative 'authproto/insecure_http_client'
 require_relative 'authproto/localhost_server'
-require_relative 'authproto/serialization/dpop_key'
 require_relative 'authproto/validated_uri'
 require_relative 'authproto/version'
 

data/sig/authproto/client.rbs

@@ -15,9 +15,9 @@ module AuthProto
     attr_reader session_manager: State::SessionManager
     attr_reader dpop_client: DPoP::Client
 
-    def initialize: (client_id: String, redirect_uri: String, ?metadata: json_object?, ?dpop_key: (json_object | JOSE::Map)?, ?signing_key: (json_object | JOSE::JWK)?) -> void
+    def initialize: (client_id: String, redirect_uri: String, ?metadata: json_object?, ?signing_key: (json_object | JOSE::JWK)?) -> void
     def authorize: (?handle: String?, ?pds: String?, ?scope: String) -> authorization_result
-    def handle_callback: (code: String, state: String, iss: String) -> callback_result
+    def handle_callback: (code: String, state: String, iss: String, expected_session_id: String) -> callback_result
     def get_tokens: (String session_id) -> token_info?
     def refresh_token: (String session_id) -> refreshed_tokens
     def authorized?: (String session_id) -> bool
@@ -28,15 +28,13 @@ module AuthProto
     private
     def load_client_metadata: (json_object? metadata) -> Metadata::ClientMetadata
     def validate_redirect_uri: () -> void
-    def initialize_signing_key: ((json_object | JOSE::JWK)? key) -> JOSE::JWK?
-    def initialize_dpop: ((json_object | JOSE::Map)? key) -> DPoP::Client
+    def initialize_client_assertion: ((json_object | JOSE::JWK)? key) -> String?
+    def metadata_key_matches_public_key?: (json_object candidate, json_object public_key) -> bool
     def validate_auth_params: (String? handle, String? pds, String scope) -> void
-    def resolve_auth_server: (String pds) -> Metadata::AuthorizationServer
+    def resolve_auth_server_info: (String pds) -> Metadata::AuthorizationServer
     def submit_authorization_par: (Metadata::AuthorizationServer authorization_server, State::Session session, ?login_hint: String?) -> String
     def exchange_code: (code: String, session: State::Session) -> json_object
     def make_token_request: (String code, State::Session session) -> http_response
-    def requires_dpop_nonce?: (http_response response) -> bool
-    def extract_dpop_nonce: (http_response response) -> String
     def validate_token_response: (json_object response, State::Session session) -> void
   end
 end

data/sig/authproto/dependencies.rbs

@@ -15,5 +15,7 @@ module JOSE
     def self.generate_key: (untyped params) -> JWK
     def to_map: (?untyped key, ?untyped jwe) -> Map
     def to_public: () -> JWK
+    def to_public_map: () -> Map
+    def thumbprint: (?String? digest_type) -> String
   end
 end

data/sig/authproto/dpop/client.rbs

@@ -1,16 +1,23 @@
 module AuthProto
   module DPoP
     class Client
+      include HTTPHelpers
       class Error < AuthProto::Error
       end
 
-      attr_reader key_manager: KeyManager
       attr_reader proof_generator: ProofGenerator
       attr_reader nonce_manager: NonceManager
 
-      def initialize: (?key_manager: KeyManager?, ?nonce_ttl: Integer?) -> void
-      def generate_proof: (method: String, uri: String, ?access_token: String?, ?nonce: String?) -> JOSE::SignedBinary
-      def process_response: (Hash[String, String]? response_headers, String server_url) -> void
+      def initialize: (?nonce_ttl: Integer?) -> void
+      def generate_proof: (session: State::Session, method: String, uri: String, ?access_token: String?) -> JOSE::SignedBinary
+      def has_nonce_error?: (http_response response) -> bool
+      def process_response: (http_response response, server_url: String, session_id: String) -> void
+
+      def with_nonce_handling: (State::Session session, String url) { () -> http_response } -> http_response
+
+      private
+
+      def nonce_challenge?: (String? challenge) -> bool
     end
   end
 end