Use a token to authenticate a request.

Request configuration for an authorization (Authorization Code & Implicit flows)

Request configuration for an authentication (Authorization Code, Password & Client Credentials flows)

-- AuthorizationCode
let req = OAuth.AuthorizationCode
      { credentials =
          -- Only the clientId is required. Specify a secret
          -- if a Basic OAuth is required by the resource
          -- provider
          { clientId = "<my-client-id>"
          , secret = ""
          }
      -- Authorization code from the authorization result
      , code = "<authorization-code>"
      -- Token endpoint of the resource provider
      , url = "<token-endpoint>"
      -- Redirect Uri to your webserver
      , redirectUri = "<my-web-server>"
      -- Scopes requested, can be empty
      , scope = ["read:whatever"]
      -- A state, echoed back by the resource provider
      , state = Just "whatever"
      }


-- ClientCredentials
let req = OAuth.ClientCredentials
      { credentials =
          -- Credentials passed along via Basic auth
          { clientId = "<my-client-id>"
          , secret = "<my-client-secret>"
          }
      -- Token endpoint of the resource provider
      , url = "<token-endpoint>"
      -- Scopes requested, can be empty
      , scope = ["read:whatever"]
      -- A state, echoed back by the resource provider
      , state = Just "whatever"
      }


-- Password
let req = OAuth.Password
      { credentials = Just
          -- Optional, unless required by the resource provider
          { clientId = "<my-client-id>"
          , secret = "<my-client-secret>"
          }
      -- Resource owner's password
      , password = "<user-password>"
      -- Scopes requested, can be empty
      , scope = ["read:whatever"]
      -- A state, echoed back by the resource provider
      , state = Just "whatever"
      -- Token endpoint of the resource provider
      , url = "<token-endpoint>"
      -- Resource owner's username
      , username = "<user-username>"
      }


-- Refresh
let req = OAuth.Refresh
      -- Optional, unless required by the resource provider
      { credentials = Nothing
      -- Scopes requested, can be empty
      , scope = ["read:whatever"]
      -- A refresh token previously delivered
      , token = OAuth.Bearer "abcdef1234567890"
      -- Token endpoint of the resource provider
      , url = "<token-endpoint>"
      }

Describes a couple of client credentials used for Basic authentication

Describes the desired type of response to an authorization. Use Code to ask for an authorization code and continue with the according flow. Use Token to do an implicit authentication and directly retrieve a Token from the authorization.

Gets the String representation of a ResponseType.

The response obtained as a result of an authentication (implicit or not)

• expiresIn (RECOMMENDED): The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value.

• refreshToken (OPTIONAL): The refresh token, which can be used to obtain new access tokens using the same authorization grant as described in Section 6.

• scope (OPTIONAL, if identical to the scope requested; otherwise, REQUIRED): The scope of the access token as described by Section 3.3.

• state (REQUIRED if state was present in the authentication request): The exact value received from the client

• token (REQUIRED): The access token issued by the authorization server.

The response obtained as a result of an authorization

• code (REQUIRED): The authorization code generated by the authorization server. The authorization code MUST expire shortly after it is issued to mitigate the risk of leaks. A maximum authorization code lifetime of 10 minutes is RECOMMENDED. The client MUST NOT use the authorization code more than once. If an authorization code is used more than once, the authorization server MUST deny the request and SHOULD revoke (when possible) all tokens previously issued based on that authorization code. The authorization code is bound to the client identifier and redirection URI.

• state (REQUIRED if state was present in the authorization request): The exact value received from the client

Describes the type of access token to use.

• Bearer: Utilized by simply including the access token string in the request rfc6750

• Mac: Not yet supported.

Describes an OAuth error as a result of a request failure

• error (REQUIRED): A single ASCII error code.

• errorDescription (OPTIONAL) Human-readable ASCII text providing additional information, used to assist the client developer in understanding the error that occurred. Values for the errorDescription parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E.

• errorUri (OPTIONAL): A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error. Values for the errorUri parameter MUST conform to the URI-reference syntax and thus MUST NOT include characters outside the set %x21 / %x23-5B / %x5D-7E.

• state (REQUIRED if state was present in the authorization request): The exact value received from the client

Describes errors coming from attempting to parse a url after an OAuth redirection

• Empty: means there were nothing (related to OAuth 2.0) to parse
• OAuthErr: a successfully parsed OAuth 2.0 error
• Missing: means the OAuth provider didn't with all the required parameters for the given grant type.
• Invalid: means the OAuth provider did reply with an invalid parameter for the given grant type.

Describes an OAuth error response 4.1.2.1

• InvalidRequest: The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.

• UnauthorizedClient: The client is not authorized to request an authorization code using this method.

• AccessDenied: The resource owner or authorization server denied the request.

• UnsupportedResponseType: The authorization server does not support obtaining an authorization code using this method.

• InvalidScope: The requested scope is invalid, unknown, or malformed.

• ServerError: The authorization server encountered an unexpected condition that prevented it from fulfilling the request. (This error code is needed because a 500 Internal Server Error HTTP status code cannot be returned to the client via an HTTP redirect.)

• TemporarilyUnavailable: The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server. (This error code is needed because a 503 Service Unavailable HTTP status code cannot be returned to the client via an HTTP redirect.)

• Unknown: The server returned an unknown error code.

Gets the String representation of a Token.

Gets the String representation of an ErrCode.

Attempts to parse a String into an ErrCode code. Will parse to Unknown when the string isn't recognized.

A json decoder for response error carried by the Result Http.Error OAuth.ResponseToken result of an http call.