class

Authly::JWTTokenGenerator

Inherits Authly::TokenGenerator < Reference < Object

Constructors

new(config : Configuration = Authly.config)
Source

Instance methods

generate_access_token(client_id : String, scope : String, sub : String, jti : String, cert_thumbprint : String | Nil, options : IssuanceOptions | Nil, issued_at : Time, expires_at : Time) : String
Source
generate_access_token(client_id : String, scope : String, sub : String, jti : String, cert_thumbprint : String | Nil = nil) : String
Source
generate_refresh_token(client_id : String, jti : String, sub : String, scope : String, family : String, family_expires_at : Time) : String

The same, ending with the family: family_expires_at is when the sign-in that began the family stops being renewable (fexp, from Configuration#refresh_absolute_ttl), and no token of the family may outlive it. A generator that does not override this method loses that limit.

Source
generate_refresh_token(client_id : String, jti : String, sub : String, scope : String, family : String) : String

A refresh token bound to the client it was issued to (cid), carrying the scope of the grant (scope) and the id of the rotation family it belongs to (fid). Refreshing requires all three, so a generator that does not override this method issues refresh tokens that cannot be redeemed.

Source
generate_refresh_token(client_id : String, jti : String, sub : String) : String

A refresh token that remembers who it was issued for, so the access token a refresh produces is about the same subject. Generators that do not override it keep issuing tokens for the client.

Source
generate_refresh_token(client_id : String, jti : String) : String
Source
store_token_metadata(jti : String, client_id : String, scope : String, sub : String, expires_at : Time, cert_thumbprint : String | Nil = nil)
Source