IAuthorizationCodeService Interface

Provides a contract for managing OAuth 2.0 authorization codes, facilitating the authorization code flow. This interface enables the generation of unique authorization codes for authenticated sessions, the validation of these codes for user authorization, and the subsequent removal of codes once they have been used or expired, ensuring adherence to the OAuth 2.0 specification.

public interface IAuthorizationCodeService

Derived
↳ AuthorizationCodeService

Methods

IAuthorizationCodeService.AuthorizeByCodeAsync(string) Method

Validates an authorization code and processes the authorization request, authorizing the user and granting access based on the code provided. This method verifies the code's validity, ensuring it matches a previously issued code and has not expired or been used.

System.Threading.Tasks.Task<Abblix.Utils.Result<Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Common.OidcError>> AuthorizeByCodeAsync(string authorizationCode);

Parameters

authorizationCode System.String

The authorization code to be validated and processed for granting access.

Returns

System.Threading.Tasks.Task<Abblix.Utils.Result<AuthorizedGrant,OidcError>>
A task that asynchronously returns a Result<TSuccess,TFailure> representing the outcome of the authorization process, including any access tokens or refresh tokens issued as part of the grant.

IAuthorizationCodeService.GenerateAuthorizationCodeAsync(AuthorizedGrant, TimeSpan) Method

Generates a unique authorization code for a given authorization grant result and specified expiration time. The authorization code is a temporary code that the client exchanges for an access token, typically after the user has authenticated and authorized the request.

System.Threading.Tasks.Task<string> GenerateAuthorizationCodeAsync(Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant authorizedGrant, System.TimeSpan authorizationCodeExpiresIn);

Parameters

authorizedGrant AuthorizedGrant

An object encapsulating the result of the authorization grant, including user authentication session and authorization context details.

authorizationCodeExpiresIn System.TimeSpan

The duration after which the generated authorization code will expire.

Returns

System.Threading.Tasks.Task<System.String>
A task that asynchronously returns the generated authorization code as a string. This code is intended for single-use and has a limited lifetime, after which it must be exchanged for an access token or considered invalid.

IAuthorizationCodeService.RemoveAuthorizationCodeAsync(string) Method

Atomically removes an authorization code from storage and returns the grant it held, in a single get-and-remove operation. This is how a code is claimed for redemption: it enforces the single-use guarantee against a race between two simultaneous redemptions of the same code (RFC 6749 section 4.1.2) - every other caller finds the code already gone and receives an invalid_grant failure.

One exception on a single node, and it is a loss rather than a duplication: a removal can end with NOBODY receiving the grant, when the claim expires mid-protocol. A store fault after the removal costs the grant the same way, and raises rather than answering.

Two callers both receiving it needs a SECOND NODE, and that holds of the storage this library ships rather than of the seam: the read and the removal happen under one hold of a per-key gate, so within one process a redeemer is never between them while another completes a take. A host substituting its own IEntityStorage owns that property, and a naive get-then-remove reopens the duplication on one node. Across processes the gate holds nothing either: the value is read before the claim is taken, the second caller is handed what it read rather than what it removed, and the reuse check sees no issued tokens. That is issue 435, and it needs a store primitive Microsoft.Extensions.Caching.Distributed.IDistributedCache does not expose.

System.Threading.Tasks.Task<Abblix.Utils.Result<Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Common.OidcError>> RemoveAuthorizationCodeAsync(string authorizationCode);

Parameters

authorizationCode System.String

The authorization code to remove and claim.

Returns

System.Threading.Tasks.Task<Abblix.Utils.Result<AuthorizedGrant,OidcError>>
The grant when this caller won the claim; an invalid_grantOidcError otherwise. Otherwise is wider than the obvious list - a concurrent request, an earlier consumption, an expiry, a code never issued - because the claim can also CONSUME the code and still refuse, when the lock guarding it expires mid-protocol. So a refusal does not prove another request took it, and looking for one is how that case is missed.

Remarks

A successfully claimed grant whose IssuedTokens is non-empty indicates the code was already used to issue tokens (a sequential reuse), which the caller treats as a reuse to be rejected and whose tokens are revoked.

IAuthorizationCodeService.UpdateAuthorizationGrantAsync(string, AuthorizedGrant, TimeSpan) Method

Updates the authorization grant result based on a specific authorization code and expiration time. This method allows the authorization grant to be updated with new information or tokens as needed.

System.Threading.Tasks.Task UpdateAuthorizationGrantAsync(string authorizationCode, Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant authorizedGrant, System.TimeSpan authorizationCodeExpiresIn);

Parameters

authorizationCode System.String

The authorization code associated with the grant result to update.

authorizedGrant AuthorizedGrant

The updated authorization grant result containing the latest authentication and authorization details.

authorizationCodeExpiresIn System.TimeSpan

The duration after which the updated authorization code will expire.

Returns

System.Threading.Tasks.Task
A task representing the asynchronous operation of updating the authorization grant result.