Deletes an authorization code.

Takes an authorization code string and removes it from storage. Authorization codes are single-use, so they should be deleted after being exchanged for tokens. Returns true if deleted successfully.

Retrieves authorization code metadata.

Takes an authorization code string and looks up its associated metadata. Returns a map with keys [:user-id :client-id :redirect-uri :scope :nonce :expiry] if found, or nil if the code doesn’t exist or has been deleted.

Saves an authorization code with associated metadata.

Takes an authorization code string, user identifier, OAuth2 client identifier, the redirect URI from the authorization request, a vector of scope strings, an optional nonce for replay protection, and an expiration timestamp (milliseconds since epoch). Stores the code and metadata. Returns true if saved successfully.

Retrieves client configuration by client-id.

Takes an OAuth2 client identifier and looks up the client configuration. Returns the client configuration map matching the ClientConfig schema if found, or nil if the client doesn’t exist.

Registers a new client.

Takes a client configuration map matching the ClientConfig schema. Stores the client and generates a client-id if one isn’t provided. Returns the registered client configuration including the client-id.

Retrieves access token metadata.

Takes an access token string and looks up its associated metadata. Returns a map with keys [:user-id :client-id :scope :expiry] if found, or nil if the token doesn’t exist or has been revoked.

Retrieves refresh token metadata.

Takes a refresh token string and looks up its associated metadata. Returns a map with keys [:user-id :client-id :scope] if found, or nil if the token doesn’t exist or has been revoked.

Revokes a token.

Takes a token string (either access or refresh token) and revokes it, preventing it from being used in future requests. Returns true if revoked successfully.

Saves an access token.

Takes an access token string, user identifier, OAuth2 client identifier, a vector of scope strings, and an expiration timestamp (milliseconds since epoch). Stores the token and its metadata. Returns true if saved successfully.

Saves a refresh token.

Takes a refresh token string, user identifier, OAuth2 client identifier, and a vector of scope strings. Stores the token and its metadata. Refresh tokens don’t expire automatically. Returns true if saved successfully.