class

Authly::RefreshToken

Inherits Authly::GrantStrategy < Reference < Object

Redeems a refresh token (RFC 6749 section 6) with the hardening of OAuth 2.0 Security BCP / OAuth 2.1: the token must be a refresh token issued to the authenticating client, unexpired and not revoked and within the absolute lifetime of its family (refresh_absolute_ttl); it is single use (the answer carries a replacement from the same family); presenting one that was already used revokes the whole family; the scope may only narrow.

Constants

FAMILY_PREFIX = "refresh-family:"

Constructors

new(client_id : String, client_secret : String, refresh_token : String, requested_scope : String | Nil = nil)

Source

Class methods

revoke_family(family : String)

Ends the family of a refresh token: nothing it was rotated into works any more. The record only has to outlive the tokens it covers, so a store that can expire keys is given refresh_ttl.

Source

Instance methods

authorized?

Source

client_id

Source

client_secret

Source

granted_scope

The scope of the access token this redemption yields: the original one, or the narrower one asked for.

Source

refresh_family

The rotation family of the refresh token this grant redeemed, nil when it redeemed none.

Source

refresh_family_expires_at

When the family of the refresh token this grant redeemed stops being renewable; nil when it redeemed none (a new family then gets a fresh deadline).

Source

refresh_scope

The scope the replacement refresh token keeps granting, whatever this access token was narrowed to.

Source

refresh_token

Source

subject

The subject the refresh token was issued for. One issued for the client itself (or by an older version, which always said so) identifies nobody.

Source