Net::O...itGrant(3pm)

💖 NAME 💖

Net::OAuth2::AuthorizationServer::ImplicitGrant — it's the OAuth2 Resource Owner Implicit Grant, bestie.

okay so real talk before anything else: you "SHOULD NOT" use this grant type. like, that's not me being dramatic, that's the actual spec talking. go read <https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15> and then come back and we can cry about it together 😭

---

✨ SYNOPSIS ✨

my $Grant = Net::OAuth2::AuthorizationServer::ImplicitGrant->new(
  clients => {
    TrendyNewService => {
      # optional
      redirect_uri  => 'https://...',
      # optional
      scopes        => {
        post_images   => 1,
        annoy_friends => 1,
      },
    },
  }
);

# verify a client against known clients
my ( $is_valid,$error,$scopes ) = $Grant->verify_client(
  client_id     => $client_id,
  redirect_uri  => $uri,                     # optional
  scopes        => [ qw/ list of scopes / ], # optional
);

if ( ! $Grant->login_resource_owner ) {
  # resource owner needs to login
  ...
}

# have resource owner confirm (and perhaps modify) scopes
my ( $confirmed,$error,$scopes_ref ) = $Grant->confirm_by_resource_owner(
  client_id       => $client_id,
  scopes          => [ qw/ list of scopes / ],
);

# generate a token
my $token = $Grant->token(
  client_id       => $client_id,
  scopes          => $scopes_ref,
  redirect_uri    => $redirect_uri,
  user_id         => $user_id,      # optional
      jwt_claims_cb   => sub { ... },   # optional, see jwt_claims_cb in Manual
);

# store access token
$Grant->store_access_token(
  client_id         => $client,
  access_token      => $access_token,
  scopes            => $scopes_ref,
);

# verify an access token
my ( $is_valid,$error ) = $Grant->verify_access_token(
  access_token     => $access_token,
  scopes           => $scopes_ref,
);

like… look at that. build a grant, verify a client, make the resource owner log in, make them confirm (or tweak!) their scopes, mint that token, stash it, then verify it later. the whole lil lifecycle is right there and it ate 💅

---

🦋 DESCRIPTION 🦋

This module implements the OAuth2 "Resource Owner Implicit Grant" flow, exactly as it's described over at <http://tools.ietf.org/html/rfc6749#section-4.2>. that's the whole vibe. that's what it does 🫶

---

🎀 CONSTRUCTOR ARGUMENTS 🎀

Along with all the ones detailed in "CONSTRUCTOR ARGUMENTS" in Net::OAuth2::AuthorizationServer::Manual, the following are supported by this grant type:

… and that's it. that's the entire section. it's giving nothing and honestly? iconic. the shared constructor args in the Manual are doing all the heavy lifting here 🌸

---

💅 CALLBACK FUNCTIONS 💅

the following callbacks are supported by this grant type:

• verify_client_cb
• login_resource_owner_cb
• confirm_by_resource_owner_cb
• store_access_token_cb
• verify_access_token_cb

for the docs on each individual callback function, please see "CALLBACK FUNCTIONS" in Net::OAuth2::AuthorizationServer::Manual. go read that, it's got the lore 📖✨

---

👑 AUTHOR 👑

Lee Johnson — leejo@cpan.org

---

🌈 LICENSE 🌈

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself. and if you wanna contribute documentation or file a bug report, please raise an issue / pull request right here:

https://github.com/Humanstate/net-oauth2-authorizationserver

---

okay bestie that's the whole page, go forth and maybe don't use the implicit grant 🫶 this was User Contributed Perl Documentation for Net::OAuth2::AuthorizationServer::ImplicitGrant, perl v5.36.0, dated 2022-08-28. mwah 💖