Narrow integration helpers for Phoenix hosts.
attesto_mcp_server remains the protected resource and does not mount or
configure an authorization server. When a host already uses
attesto_phoenix, attesto_config/1 derives the core Attesto.Config from
that package's validated application configuration, while
protected_resource_options/1 also derives its runtime DPoP and mTLS
callbacks, access-token revocation check, and principal loader;
protected_resource_options/2 can compose a post-load principal callback
without replacing those checks. These helpers introduce no hard dependency
in this package.
Summary
Types
A post-load callback that may transform or reject the AttestoPhoenix principal.
Options for composing the automatic protected-resource principal path.
Functions
Derives an Attesto verifier configuration from an installed
attesto_phoenix host.
Derives the complete protected-resource authentication options from an
installed attesto_phoenix host.
Derives protected-resource options and composes a post-load principal callback.
Types
@type principal_wrapper() :: (term(), map(), term() -> {:ok, term()} | {:error, term()}) | {module(), atom()} | {module(), atom(), [term()]}
A post-load callback that may transform or reject the AttestoPhoenix principal.
@type protected_resource_option() :: {:principal, principal_wrapper()}
Options for composing the automatic protected-resource principal path.
Functions
Derives an Attesto verifier configuration from an installed
attesto_phoenix host.
The host must configure AttestoPhoenix.Config under otp_app. This helper
fails closed when the optional package or its supported configuration API is
unavailable.
Derives the complete protected-resource authentication options from an
installed attesto_phoenix host.
The returned keyword contains the core Attesto.Config plus the runtime
DPoP replay, nonce, canonical-URL, and mTLS certificate callbacks enabled by
the host's validated AttestoPhoenix.Config. Its principal callback checks
the access-token jti through the host's revocation store before resolving
the verified subject through load_principal. Resolve it at request time:
the adapter callbacks close over the current validated configuration and
must not be baked into a compiled Phoenix router.
attesto_phoenix 3.x and 4.x bind each callback to the named profile loaded from
the otp_app argument, so multiple named host profiles remain isolated.
This helper does not select a profile from conn.private. The 2.14
compatibility path supports one globally configured profile; using it for
multiple profiles can route persistent replay or revocation reads through
that global profile's store. Use attesto_phoenix 3.x or 4.x when serving more than
one named profile.
This helper fails closed when the optional package or its supported public configuration/adapter API is unavailable.
@spec protected_resource_options(atom(), [protected_resource_option()]) :: keyword()
Derives protected-resource options and composes a post-load principal callback.
The optional :principal callback receives the loaded principal, verified
claims, and sender information, in that order. It must return
{:ok, principal} with a non-nil final principal or {:error, reason}. The
automatic JTI revocation check and AttestoPhoenix load_principal callback
always run first and cannot be replaced by this option.