AshScim.Auth behaviour (ash_scim v0.1.0)

Copy Markdown View Source

Behaviour for authenticating inbound SCIM requests.

An AshScim.Router is configured with one auth implementation; the router invokes authenticate/2 before any resource handler runs. Returning {:ok, conn, actor} allows the request to proceed (the actor is passed to Ash actions); returning {:error, reason} halts with a 401 SCIM error.

Built-in implementations:

  • AshScim.Auth.StaticBearer — accepts one or more bearer tokens from configuration. Useful for development and simple deployments.

Planned: an AshScim.Auth.AshAuthenticationToken adapter that delegates to the host app's AshAuthentication.TokenResource so SCIM bearer tokens live alongside the existing token store and inherit its revocation semantics.

Summary

Types

actor()

Optional Ash actor to use for actions performed by the request.

config()

Implementation module + opts (the second tuple element is passed verbatim to the callbacks).

Callbacks

authenticate(t, keyword)

Authenticate conn. Return {:ok, conn, actor} to proceed (the conn may be modified, e.g. to stash details), or {:error, reason} to reject.

Types

actor()

@type actor() :: term() | nil

Optional Ash actor to use for actions performed by the request.

config()

@type config() :: {module(), keyword()}

Implementation module + opts (the second tuple element is passed verbatim to the callbacks).

Callbacks

authenticate(t, keyword)

@callback authenticate(Plug.Conn.t(), keyword()) ::
  {:ok, Plug.Conn.t(), actor()} | {:error, String.t()}

Authenticate conn. Return {:ok, conn, actor} to proceed (the conn may be modified, e.g. to stash details), or {:error, reason} to reject.