soma_auth/cimd.rs
1//! OAuth Client ID Metadata Documents (CIMD) support for soma-auth acting
2//! as an Authorization Server.
3//!
4//! Lets an incoming `client_id` be an `https://` URL pointing at a JSON
5//! metadata document instead of requiring prior Dynamic Client Registration
6//! (RFC 7591). See `document::fetch_and_validate_client_metadata` for the
7//! guarded fetch path and `ssrf` for the SSRF preflight guard it composes.
8//!
9//! A CIMD document's `redirect_uris` are NOT trusted outright — the
10//! consumer in `authorize.rs` filters them through the same
11//! `is_allowed_redirect_uri` check DCR-registered clients are held to. See
12//! that module's `resolve_client_redirect_uris` for why.
13
14pub mod document;
15pub mod ssrf;