Token Lifecycle (UI Layer)#

do {
    let model = try await OAuthLifecycle.refreshToken(
        refreshToken,
        haapiUIKitApplication: UIApplication.shared.haapiUIKitApplication
    )
    switch model {
    case let token as OAuthTokenModel:
        // Persist the new pair — the previous refresh token is now spent.
        TokenStore.shared.save(token)
    case let error as OAuthErrorModel:
        // e.g. invalid_grant — the refresh token is no longer usable.
        startReauthentication(reason: error.errorDescription)
    default:
        break
    }
} catch {
    // Building the accessor failed (DCR or configuration) — a transport failure
    // during the refresh itself arrives as an OAuthErrorModel above.
    presentAlert("Could not refresh the token: \(error)")
}

additionalParameters: takes a [String: String] appended to the request body when the client needs extra token-endpoint parameters.

lifecycleScope.launch {
    val widgetConfiguration = (application as HaapiUIWidgetApplication).widgetConfiguration
    try {
        when (
            val model = OAuthLifecycle.refreshAccessToken(
                refreshToken = refreshToken,
                widgetConfiguration = widgetConfiguration
            )
        ) {
            // Persist the new pair — the previous refresh token is now spent.
            is OauthModel.Token -> TokenStore.save(model)
            // e.g. invalid_grant — the refresh token is no longer usable.
            is OauthModel.Error -> startReauthentication(model.errorDescription)
        }
    } catch (cancellation: CancellationException) {
        throw cancellation
    } catch (exception: Exception) {
        // Transport failure, or the accessor could not be built from the configuration.
        showAlert("Could not refresh the token: $exception")
    }
}

onCoroutineContext defaults to Dispatchers.IO, so the request leaves the main thread even when the coroutine is launched from lifecycleScope. additionalParameters takes a Map<String, String> appended to the request body.

func logout() async {
    do {
        try await OAuthLifecycle.revokeAccessToken(
            accessToken,
            haapiUIKitConfiguration: UIApplication.shared.haapiUIKitApplication.haapiUIKitConfiguration
        )
        try await OAuthLifecycle.revokeRefreshToken(
            refreshToken,
            haapiUIKitConfiguration: UIApplication.shared.haapiUIKitApplication.haapiUIKitConfiguration
        )
        // Only clear once the server has revoked — see the warning below.
        TokenStore.shared.clear()
    } catch {
        // Transport failure, an OAuth error from the server, or no revocation endpoint configured.
        presentAlert("Could not revoke the token: \(error)")
    }
}

private suspend fun logout() {
    val widgetConfiguration = (application as HaapiUIWidgetApplication).widgetConfiguration
    try {
        OAuthLifecycle.revokeAccessToken(
            accessToken = accessToken,
            widgetConfiguration = widgetConfiguration
        )
        OAuthLifecycle.revokeRefreshToken(
            refreshToken = refreshToken,
            widgetConfiguration = widgetConfiguration
        )
        // Only clear once the server has revoked — see the warning below.
        TokenStore.clear()
    } catch (cancellation: CancellationException) {
        throw cancellation
    } catch (exception: Exception) {
        // Transport failure, an OAuth error from the server, or no revocation endpoint configured.
        showAlert("Could not revoke the token: $exception")
    }
}

var haapiUIKitConfiguration = HaapiUIKitConfigurationBuilder(
    clientId: Constants.clientId,
    baseUrl: Constants.baseURL,
    tokenEndpointUrl: Constants.tokenEndpointURL,
    authorizationEndpointUrl: Constants.authorizationEndpointURL,
    appRedirect: Constants.appRedirectURIString
)
.setRevocationEndpointUrl(endpoint: Constants.revocationEndpointURL)
.build()

override val widgetConfiguration: WidgetConfiguration
    get() = WidgetConfiguration.Builder(
        clientId = "my-client-id",
        baseUri = baseUri,
        tokenEndpointUri = baseUri.resolve("/oauth/v2/oauth-token"),
        authorizationEndpointUri = baseUri.resolve("/oauth/v2/oauth-authorize"),
        appRedirect = "app://haapi"
    ).setRevocationEndpointUri(baseUri.resolve("/oauth/v2/oauth-revoke"))
        .build()

guard let dpop = try await OAuthLifecycle.dpop(
    forAccessToken: accessToken,
    haapiUIKitConfiguration: UIApplication.shared.haapiUIKitApplication.haapiUIKitConfiguration
) else {
    return // no DPoP is bound to that token
}

var request = URLRequest(url: apiURL)
request.addAuthorizationHeader(headerValue: "DPoP \(accessToken)")
request.addDpopHeader(headerValue: try dpop.getHeaderValue(httpMethod: "GET",
                                                           url: apiURL,
                                                           nonce: resourceServerNonce,
                                                           accessToken: accessToken))

private suspend fun callApi(accessToken: String, apiUri: URI) {
    val widgetConfiguration = (application as HaapiUIWidgetApplication).widgetConfiguration
    val dpopHelper = OAuthLifecycle.dpopHelper(
        widgetConfiguration = widgetConfiguration,
        accessToken = accessToken
    ) ?: return // no key for this token — not token-bound, or already replaced by a refresh

    val proof = dpopHelper.generateProofToken(
        method = "GET",
        uri = apiUri,
        nonce = resourceServerNonce,
        accessToken = accessToken
    )

    val connection = (apiUri.toURL().openConnection() as HttpURLConnection).apply {
        requestMethod = "GET"
        setRequestProperty(HttpConstants.Headers.AUTHORIZATION, "DPoP $accessToken")
        setRequestProperty(HttpConstants.Headers.DPOP, proof)
    }
}

onCoroutineContext defaults to Dispatchers.IO, so the Keystore read leaves the main thread.