Lets this instance's users sign in to other gerbeur instances with their account here, as identity-provider-service.ts describes. The client's /authorize page calls the first two; the other instance's server calls the last.

  • GET /api/oauth/clients?client_id= — signed in. Answers the instance asking to sign the caller in (OAuthClient), and whether they already let it; 400 for an account from another instance, 403 when that instance is blocked here, 502 when it doesn't answer as a gerbeur.
  • POST /api/oauth/codes — signed in. Records the caller's consent to the request (AuthorizeRequest) and answers where to send them, the instance's callback page with a code.
  • POST /api/oauth/tokens — public, form-encoded, server to server. Trades a code and its PKCE verifier for an identity token (id_token), bare JSON as OAuth has it; 400 when anything doesn't match. Rate-limited per client.

Variables

v
default: Router

Mounted by api/main.ts behind the error, Open Graph and CORS middleware. An APIException thrown by a handler becomes the JSON error response there.

Usage

import * as mod from "api/routes/oauth.ts";