h&92i      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~  Safe-Inferred "%&1; 5 hoauth2!type synonym of post body contenthoauth2 2https://www.rfc-editor.org/rfc/rfc6749#section-2.3 According to spec:The client MUST NOT use more than one authentication method in each request.2Which means use Authorization header or Post body.However, in reality, I always have to include authentication in the header.In other words, ClientSecrectBasic is always assured.  is optional.Maybe consider an alternative implementation that boolean kind of data type is good enough. hoauth2 4https://www.rfc-editor.org/rfc/rfc6749#section-4.1.4 hoauth2 Exists when offline_access scope is in the  authorizeUrl0 and the provider supports Refresh Access Token.hoauth2See  2https://www.rfc-editor.org/rfc/rfc6749#section-5.1. It's required per spec. But OAuth2 provider implementation are vary. Maybe will remove  in future release.hoauth2 Exists when openid scope is in the  authorizeUrl" and the provider supports OpenID.hoauth2Authorization Codehoauth2Query Parameter Representation.hoauth2Parse JSON data into  ,   #"! $%&'()*+,#"!    $%&'()*+ Safe-Inferred"%&1;INhoauth2 0https://www.rfc-editor.org/rfc/rfc6750#section-2Ohoauth2 Provides in Authorization headerPhoauth2Provides in request bodyQhoauth2#Provides in request query parameterRhoauth2Conduct an authorized GET request and return response as JSON. Inject Access Token to Authorization Header.Thoauth2Conduct an authorized GET request and return response as JSON. Allow to specify how to append AccessToken.Uhoauth2Conduct an authorized GET request. Inject Access Token to Authorization Header.Vhoauth2Same to U; but set access token to query parameter rather than headerXhoauth2Conduct an authorized GET request and return response as ByteString. Allow to specify how to append AccessToken.Yhoauth2Conduct POST request and return response as JSON. Inject Access Token to Authorization Header.[hoauth2Conduct POST request and return response as JSON. Allow to specify how to append AccessToken.\hoauth2Conduct POST request. Inject Access Token to http header (Authorization)]hoauth2Conduct POST request with access token only in the request body but header.^hoauth2Conduct POST request with access token only in the header and not in body`hoauth2Conduct POST request and return response as ByteString. Allow to specify how to append AccessToken.hoauth2Send an HTTP request.hoauth2Get response body out of a Responsehoauth20Set several header values: + userAgennt : hoauth2> + accept : `application/json` + authorization : Bearer xxxxx if  provided.hoauth2Set the HTTP method to use.hoauth2For GET method API.hoauth2Create  with given access token value.Rhoauth2HTTP connection manager.hoauth2Response as JSONShoauth2HTTP connection manager.hoauth2Response as JSONThoauth2HTTP connection manager.hoauth2Response as JSONUhoauth2HTTP connection manager.hoauth2Response as ByteStringVhoauth2HTTP connection manager.hoauth2Response as ByteStringWhoauth2HTTP connection manager.hoauth2Response as ByteStringXhoauth2'Specify the way that how to append the  in the requesthoauth2HTTP connection manager.hoauth2Response as ByteStringYhoauth2HTTP connection manager.hoauth2Response as JSONZhoauth2HTTP connection manager.hoauth2Response as ByteString[hoauth2HTTP connection manager.hoauth2Response as ByteString\hoauth2HTTP connection manager.hoauth2Response as ByteString]hoauth2HTTP connection manager.hoauth2Response as ByteString^hoauth2HTTP connection manager.hoauth2Response as ByteString_hoauth2HTTP connection manager.hoauth2Response as ByteString`hoauth2HTTP connection manager.hoauth2Response as ByteStringhoauth2Request to performhoauth2Modify request before sendinghoauth2HTTP connection manager.hoauth2Base URIhoauth2Authorized Access Tokenhoauth2Combined ResultNOQPRSTUVWXYZ[\]^_`RUVTSXWY\]^[Z`_NOQP Safe-Inferred "%&1;5choauth2)Authorization Code Grant Error Responses  3https://tools.ietf.org/html/rfc6749#section-4.1.2.1 I found hard time to figure a way to test the authorization error flow When anything wrong in  /authorize request (redirect to OAuth2 provider), it will end-up at the Provider page hence no way for this library to parse error response. In other words,  /authorize ends up with 4xx or 5xx. Revisit this whenever find a case OAuth2 provider redirects back to Relying party with errors.khoauth2See llhoauth2Prepare the authorization URL. Redirect to this URL asking for user interactive authentication. cjihgedfkl cjihgedfkl Safe-Inferred "%&1;'rhoauth2Token Error Responses /https://tools.ietf.org/html/rfc6749#section-5.2yhoauth2Prepare the URL and the request body query for fetching an access token.zhoauth2Obtain a new access token by sending a Refresh Token to the Authorization server.{hoauth2 Exchange code9 for an Access Token with authenticate in request header.~hoauth2 Exchange code for an Access TokenOAuth2 spec allows credential ( client_id,  client_secret*) to be sent either in the header (a.k.a !). or as form/url params (a.k.a ).The OAuth provider can choose to implement only one, or both. Look for API document from the OAuth provider you're dealing with. If you're uncertain, try { which sends credential in authorization http header, which is common case.hoauth2Fetch a new AccessToken using the Refresh Token with authentication in request header.hoauth20Fetch a new AccessToken using the Refresh Token.OAuth2 spec allows credential ( client_id,  client_secret*) to be sent either in the header (a.k.a !). or as form/url params (a.k.a ).The OAuth provider can choose to implement only one, or both. Look for API document from the OAuth provider you're dealing with. If you're uncertain, try  which sends credential in authorization http header, which is common case.hoauth21Conduct post request and return response as JSON.hoauth2Conduct post request.hoauth2Gets response body from a Response if 200 otherwise assume hoauth2Try to parses response as JSON, if failed, try to parse as like query string.hoauth2=Parses the response that contains not JSON but a Query Stringhoauth20Set several header values: + userAgennt : hoauth2( + accept : `application/json`hoauth2Add Credential (client_id, client_secret) to the request post body. yhoauth2(access code gained via authorization URLhoauth2/access token request URL plus the request body.zhoauth2*Refresh Token gained via authorization URLhoauth20Refresh Token request URL plus the request body.{hoauth2HTTP connection managerhoauth2 OAuth Datahoauth2 OAuth2 Codehoauth2 Access Token|hoauth2HTTP connection managerhoauth2 OAuth Datahoauth2Authorization Codehoauth2 Access Token}hoauth2HTTP connection managerhoauth2 OAuth Datahoauth2Authorization Codehoauth2 Access Token~hoauth2HTTP connection managerhoauth2 OAuth Datahoauth2Authorization Codehoauth2 Access Tokenhoauth2HTTP connection manager.hoauth2 OAuth contexthoauth2(Refresh Token gained after authorizationhoauth2HTTP connection manager.hoauth2 OAuth contexthoauth2(Refresh Token gained after authorizationhoauth2HTTP connection manager.hoauth2 OAuth contexthoauth2(Refresh Token gained after authorizationhoauth2HTTP connection manager.hoauth2 OAuth contexthoauth2(Refresh Token gained after authorizationhoauth2HTTP connection manager.hoauth2 OAuth optionshoauth2The URLhoauth2 request bodyhoauth2Response as JSONhoauth2HTTP connection manager.hoauth2 OAuth optionshoauth2URLhoauth2 Request body.hoauth2Response as ByteStringrwutxvsyz{|}~rwutxvsyz{|}~ Safe-Inferred "%&1;(x   #"! $%&'()*+NPOQRSTUVWXYZ[\]^_`klyz{|}~klyz{|}~ Safe-Inferred "%&1;)hoauth2spec says optional but really it shall be s256 or can be omitted? 9https://datatracker.ietf.org/doc/html/rfc7636#section-4.3 Safe-Inferred "%&1;*( Safe-Inferred"%&12;/n hoauth2-Shall IdpApplication has a field of 'Idp a'??hoauth2 .https://www.rfc-editor.org/rfc/rfc6749#page-47hoauth2Each GrantTypeFlow has slightly different request parameter to /token endpoint.hoauth2Only 'AuthorizationCode flow (but not resource owner password nor client credentials) will use  in the token request create type family to be explicit on it. with 'type instance WithExchangeToken a b = b' implies no exchange token v.s. 'type instance WithExchangeToken a b = ExchangeToken -> b' implies needing an exchange tokenhoauth20Grant type query parameter has association with  but not completely strict. e.g. Both  and ' flow could support refresh token flow.hoauth2Any parameter that required by your Idp and not mentioned in the OAuth2 spechoauth2Any parameter that required by your Idp and not mentioned in the OAuth2 spechoauth2Though technically one key can have multiple value in query, but who actually does it?!hoauth2+In order to reuse some methods from legacy Network.OAuth.OAuth2:. Will be removed when Experiment module becomes default.hoauth26An Application that supports "Authorization code" flowhoauth2 TODO: TBD  Safe-Inferred"%&1;1X     !!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstfguvhwkxyz{|}~pqrst$hoauth2-2.6.0-B6PU9XFvhi0G80sxl5r9bLNetwork.OAuth.OAuth2.InternalNetwork.OAuth.OAuth2.HttpClient)Network.OAuth.OAuth2.AuthorizationRequest!Network.OAuth.OAuth2.TokenRequestNetwork.OAuth2.Experiment.PkceNetwork.OAuth2.Experiment.UtilsNetwork.OAuth2.Experiment.TypesNetwork.OAuth.OAuth2Network.OAuth2.Experiment QueryParamsPostBodyClientAuthenticationMethodClientSecretBasicClientSecretPost OAuth2ErrorerrorerrorDescriptionerrorUri OAuth2Token accessToken refreshToken expiresIn tokenTypeidToken ExchangeTokenextokenIdTokenidtoken RefreshTokenrtoken AccessTokenatokenOAuth2oauth2ClientIdoauth2ClientSecretoauth2AuthorizeEndpointoauth2TokenEndpointoauth2RedirectUriparseOAuth2ErrormkDecodeOAuth2ErrordefaultRequestHeadersappendQueryParams uriToRequest requestToUrihostLensportLens$fDefaultOAuth2$fToJSONOAuth2Token$fFromJSONOAuth2Token$fBinaryOAuth2Token$fToJSONOAuth2Error$fFromJSONOAuth2Error$fEqClientAuthenticationMethod$fOrdClientAuthenticationMethod$fShowOAuth2Error$fEqOAuth2Error$fGenericOAuth2Error$fEqOAuth2Token$fShowOAuth2Token$fGenericOAuth2Token$fShowExchangeToken$fFromJSONExchangeToken$fToJSONExchangeToken$fBinaryIdToken $fEqIdToken $fShowIdToken$fFromJSONIdToken$fToJSONIdToken$fBinaryRefreshToken$fEqRefreshToken$fShowRefreshToken$fFromJSONRefreshToken$fToJSONRefreshToken$fBinaryAccessToken$fEqAccessToken$fShowAccessToken$fFromJSONAccessToken$fToJSONAccessToken $fShowOAuth2 $fEqOAuth2APIAuthenticationMethodAuthInRequestHeaderAuthInRequestBodyAuthInRequestQuery authGetJSONauthGetJSONInternalauthGetJSONWithAuthMethod authGetBS authGetBS2authGetBSInternalauthGetBSWithAuthMethod authPostJSONauthPostJSONInternalauthPostJSONWithAuthMethod authPostBS authPostBS2 authPostBS3authPostBSInternalauthPostBSWithAuthMethod$fEqAPIAuthenticationMethod$fOrdAPIAuthenticationMethodErrorsInvalidRequestUnauthorizedClient AccessDeniedUnsupportedResponseType InvalidScope ServerErrorTemporarilyUnavailableauthorizationUrlauthorizationUrlWithParams$fToJSONErrors$fFromJSONErrors $fShowErrors $fEqErrors$fGenericErrors InvalidClient InvalidGrantUnsupportedGrantTypeaccessTokenUrlrefreshAccessTokenUrlfetchAccessTokenfetchAccessToken2fetchAccessTokenInternalfetchAccessTokenWithAuthMethodrefreshAccessTokenrefreshAccessToken2refreshAccessTokenInternal refreshAccessTokenWithAuthMethoddoJSONPostRequestdoSimplePostRequesthandleOAuth2TokenResponseparseResponseFlexibleparseResponseStringaddDefaultRequestHeadersclientSecretPostPkceRequestParam codeVerifier codeChallengecodeChallengeMethodCodeChallengeMethodS256 CodeVerifierunCodeVerifier CodeChallengeunCodeChallenge mkPkceParam$fShowCodeChallengeMethod$fShowCodeVerifiertlToBS bs8ToLazyText mapsToParamsIdpApplicationIdp$sel:idpUserInfoEndpoint:Idp$sel:idpAuthorizeEndpoint:Idp$sel:idpTokenEndpoint:Idp$sel:idpFetchUserInfo:IdpHasUserInfoRequestconduitUserInfoRequest IdpUserInfoHasRefreshTokenRequestRefreshTokenRequestmkRefreshTokenRequestconduitRefreshTokenRequestHasPkceTokenRequestconduitPkceTokenRequestHasPkceAuthorizeRequestmkPkceAuthorizeRequestHasTokenRequest TokenRequestWithExchangeTokenmkTokenRequestconduitTokenRequestHasAuthorizeRequestAuthorizationRequestMkAuthorizationRequestResponsemkAuthorizeRequestParametermkAuthorizeRequest HasIdpAppName getIdpAppName ToQueryParam toQueryParamPassword$sel:unPassword:PasswordUsername$sel:unUsername:UsernameAuthorizeState$$sel:unAuthorizeState:AuthorizeState RedirectUri$sel:unRedirectUri:RedirectUri ClientSecret $sel:unClientSecret:ClientSecretClientId$sel:unClientId:ClientIdScope$sel:unScope:ScopeGrantTypeValueGTAuthorizationCode GTPasswordGTClientCredentialsGTRefreshTokenToResponseTypeValuetoResponseTypeValue GrantTypeFlowAuthorizationCodeResourceOwnerPasswordClientCredentialsClientCredentialsIDPAppConfig1$sel:idpAppClientId:ClientCredentialsIDPAppConfig5$sel:idpAppClientSecret:ClientCredentialsIDPAppConfig-$sel:idpAppName:ClientCredentialsIDPAppConfig.$sel:idpAppScope:ClientCredentialsIDPAppConfig$sel:idpAppTokenRequestExtraParams:ClientCredentialsIDPAppConfig&$sel:idp:ClientCredentialsIDPAppConfig!ResourceOwnerPasswordIDPAppConfig5$sel:idpAppClientId:ResourceOwnerPasswordIDPAppConfig9$sel:idpAppClientSecret:ResourceOwnerPasswordIDPAppConfig1$sel:idpAppName:ResourceOwnerPasswordIDPAppConfig2$sel:idpAppScope:ResourceOwnerPasswordIDPAppConfig5$sel:idpAppUserName:ResourceOwnerPasswordIDPAppConfig5$sel:idpAppPassword:ResourceOwnerPasswordIDPAppConfig$sel:idpAppTokenRequestExtraParams:ResourceOwnerPasswordIDPAppConfig*$sel:idp:ResourceOwnerPasswordIDPAppConfigAuthorizationCodeIdpApplication/$sel:idpAppName:AuthorizationCodeIdpApplication3$sel:idpAppClientId:AuthorizationCodeIdpApplication7$sel:idpAppClientSecret:AuthorizationCodeIdpApplication0$sel:idpAppScope:AuthorizationCodeIdpApplication6$sel:idpAppRedirectUri:AuthorizationCodeIdpApplication9$sel:idpAppAuthorizeState:AuthorizationCodeIdpApplication?$sel:idpAppAuthorizeExtraParams:AuthorizationCodeIdpApplication$sel:idpAppTokenRequestAuthenticationMethod:AuthorizationCodeIdpApplication($sel:idp:AuthorizationCodeIdpApplicationtoResponseTypeParam toOAuth2Key&$fToResponseTypeValueAuthorizationCode$fIsStringScope$fIsStringAuthorizeState$fIsStringUsername$fIsStringPassword$fToQueryParamRefreshToken$fToQueryParamExchangeToken!$fToQueryParamCodeChallengeMethod$fToQueryParamCodeChallenge$fToQueryParamCodeVerifier$fToQueryParamSet$fToQueryParamRedirectUri$fToQueryParamAuthorizeState$fToQueryParamPassword$fToQueryParamUsername$fToQueryParamClientSecret$fToQueryParamClientId$fToQueryParamGrantTypeValue$fToQueryParamMaybe)$fHasUserInfoRequestResourceOwnerPassword%$fHasUserInfoRequestAuthorizationCode-$fHasRefreshTokenRequestResourceOwnerPassword!$fToQueryParamRefreshTokenRequest)$fHasRefreshTokenRequestAuthorizationCode$fToQueryParamTokenRequest"$fHasTokenRequestClientCredentials$fToQueryParamTokenRequest0&$fHasTokenRequestResourceOwnerPassword$fToQueryParamTokenRequest1&$fHasPkceTokenRequestAuthorizationCode"$fHasTokenRequestAuthorizationCode"$fToQueryParamAuthorizationRequest*$fHasPkceAuthorizeRequestAuthorizationCode&$fHasAuthorizeRequestAuthorizationCode $fHasIdpAppNameClientCredentials$$fHasIdpAppNameResourceOwnerPassword $fHasIdpAppNameAuthorizationCode $fEqPassword $fEqUsername$fEqAuthorizeState$fEqRedirectUri$fEqClientSecret$fIsStringClientSecret$fShowClientId $fEqClientId$fIsStringClientId $fShowScope $fEqScope $fOrdScope$fEqGrantTypeValue$fShowGrantTypeValuebase GHC.MaybeMaybe authRequesthandleResponseupdateRequestHeaders setMethodappendAccessTokenaccessTokenToParam%D:R:IdpApplicationAuthorizationCodei0$AuthorizationCodeTokenRefreshRequest3$sel:grantType:AuthorizationCodeTokenRefreshRequest/$sel:scope:AuthorizationCodeTokenRefreshRequest6$sel:refreshToken:AuthorizationCodeTokenRefreshRequestPasswordRefreshTokenRequestAuthorizationCodeTokenRequest"$sel:password:PasswordTokenRequest"$sel:username:PasswordTokenRequest,$sel:grantType:AuthorizationCodeTokenRequest#$sel:grantType:PasswordTokenRequest,$sel:grantType:ClientCredentialsTokenRequest.$sel:redirectUri:AuthorizationCodeTokenRequest+$sel:clientId:AuthorizationCodeTokenRequest$sel:scope:PasswordTokenRequest($sel:scope:ClientCredentialsTokenRequest'$sel:code:AuthorizationCodeTokenRequestClientCredentialsTokenRequestPasswordTokenRequest%AuthorizationCodeAuthorizationRequest6$sel:redirectUri:AuthorizationCodeAuthorizationRequest3$sel:clientId:AuthorizationCodeAuthorizationRequest0$sel:scope:AuthorizationCodeAuthorizationRequest0$sel:state:AuthorizationCodeAuthorizationRequest