h&82      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~  Safe-Inferred "%&1;hoauth2spec says optional but really it shall be s256 or can be omitted? 9https://datatracker.ietf.org/doc/html/rfc7636#section-4.3  Safe-Inferred "%&1; Safe-Inferred "%&1;-  Safe-Inferred "%&1; hoauth2!type synonym of post body contenthoauth2 2https://www.rfc-editor.org/rfc/rfc6749#section-2.3 According to spec:The client MUST NOT use more than one authentication method in each request.2Which means use Authorization header or Post body.However, in reality, I always have to include authentication in the header.In other words, ClientSecrectBasic is always assured.  is optional.Maybe consider an alternative implementation that boolean kind of data type is good enough.hoauth2 4https://www.rfc-editor.org/rfc/rfc6749#section-4.1.4hoauth2 Exists when offline_access scope is in the  authorizeUrl0 and the provider supports Refresh Access Token.hoauth2See  2https://www.rfc-editor.org/rfc/rfc6749#section-5.1. It's required per spec. But OAuth2 provider implementation are vary. Maybe will remove  in future release.hoauth2 Exists when openid scope is in the  authorizeUrl" and the provider supports OpenID.hoauth2Authorization Code'hoauth2Query Parameter Representationhoauth2Parse JSON data into & !#"$&%'-,+*)(./0123 Safe-Inferred "%&1;4hoauth2Token Error Responses /https://tools.ietf.org/html/rfc6749#section-5.2Bhoauth2Prepare the URL and the request body query for fetching an access token.Choauth2Obtain a new access token by sending a Refresh Token to the Authorization server.Dhoauth2 Exchange code9 for an Access Token with authenticate in request header.Ghoauth2 Exchange code for an Access TokenOAuth2 spec allows credential ( client_id,  client_secret*) to be sent either in the header (a.k.a !). or as form/url params (a.k.a ).The OAuth provider can choose to implement only one, or both. Look for API document from the OAuth provider you're dealing with. If you're uncertain, try D which sends credential in authorization http header, which is common case.Hhoauth2Fetch a new AccessToken using the Refresh Token with authentication in request header.Khoauth20Fetch a new AccessToken using the Refresh Token.OAuth2 spec allows credential ( client_id,  client_secret*) to be sent either in the header (a.k.a !). or as form/url params (a.k.a ).The OAuth provider can choose to implement only one, or both. Look for API document from the OAuth provider you're dealing with. If you're uncertain, try H which sends credential in authorization http header, which is common case.Lhoauth21Conduct post request and return response as JSON.Mhoauth2Conduct post request.Nhoauth2Gets response body from a Response if 200 otherwise assume  OAuth2ErrorOhoauth2Try to parses response as JSON, if failed, try to parse as like query string.Phoauth2=Parses the response that contains not JSON but a Query StringQhoauth20Set several header values: + userAgennt : hoauth2( + accept : `application/json`Rhoauth2Add Credential (client_id, client_secret) to the request post body. Bhoauth2(access code gained via authorization URLhoauth2/access token request URL plus the request body.Choauth2*Refresh Token gained via authorization URLhoauth20Refresh Token request URL plus the request body.Dhoauth2HTTP connection managerhoauth2 OAuth Datahoauth2 OAuth2 Codehoauth2 Access TokenEhoauth2HTTP connection managerhoauth2 OAuth Datahoauth2Authorization Codehoauth2 Access TokenFhoauth2HTTP connection managerhoauth2 OAuth Datahoauth2Authorization Codehoauth2 Access TokenGhoauth2HTTP connection managerhoauth2 OAuth Datahoauth2Authorization Codehoauth2 Access TokenHhoauth2HTTP connection manager.hoauth2 OAuth contexthoauth2(Refresh Token gained after authorizationIhoauth2HTTP connection manager.hoauth2 OAuth contexthoauth2(Refresh Token gained after authorizationJhoauth2HTTP connection manager.hoauth2 OAuth contexthoauth2(Refresh Token gained after authorizationKhoauth2HTTP connection manager.hoauth2 OAuth contexthoauth2(Refresh Token gained after authorizationLhoauth2HTTP connection manager.hoauth2 OAuth optionshoauth2The URLhoauth2 request bodyhoauth2Response as JSONMhoauth2HTTP connection manager.hoauth2 OAuth optionshoauth2URLhoauth2 Request body.hoauth2Response as ByteString4;:98765<@?>=ABCDEFGHIJKLMNOPQR<@?>=4;:98765ABCDEFGHIJKLMNOPQR Safe-Inferred"%&1;$Zhoauth2 0https://www.rfc-editor.org/rfc/rfc6750#section-2[hoauth2 Provides in Authorization header\hoauth2Provides in request body]hoauth2#Provides in request query parameter^hoauth2Conduct an authorized GET request and return response as JSON. Inject Access Token to Authorization Header.`hoauth2Conduct an authorized GET request and return response as JSON. Allow to specify how to append AccessToken.ahoauth2Conduct an authorized GET request. Inject Access Token to Authorization Header.bhoauth2Same to a; but set access token to query parameter rather than headerdhoauth2Conduct an authorized GET request and return response as ByteString. Allow to specify how to append AccessToken.ehoauth2Conduct POST request and return response as JSON. Inject Access Token to Authorization Header.ghoauth2Conduct POST request and return response as JSON. Allow to specify how to append AccessToken.hhoauth2Conduct POST request. Inject Access Token to http header (Authorization)ihoauth2Conduct POST request with access token only in the request body but header.jhoauth2Conduct POST request with access token only in the header and not in bodylhoauth2Conduct POST request and return response as ByteString. Allow to specify how to append AccessToken.hoauth2Send an HTTP request.hoauth2Get response body out of a Responsehoauth20Set several header values: + userAgennt : hoauth2> + accept : `application/json` + authorization : Bearer xxxxx if $ provided.hoauth2Set the HTTP method to use.hoauth2For GET method API.hoauth2Create  with given access token value.^hoauth2HTTP connection manager.hoauth2Response as JSON_hoauth2HTTP connection manager.hoauth2Response as JSON`hoauth2HTTP connection manager.hoauth2Response as JSONahoauth2HTTP connection manager.hoauth2Response as ByteStringbhoauth2HTTP connection manager.hoauth2Response as ByteStringchoauth2HTTP connection manager.hoauth2Response as ByteStringdhoauth2'Specify the way that how to append the $ in the requesthoauth2HTTP connection manager.hoauth2Response as ByteStringehoauth2HTTP connection manager.hoauth2Response as JSONfhoauth2HTTP connection manager.hoauth2Response as ByteStringghoauth2HTTP connection manager.hoauth2Response as ByteStringhhoauth2HTTP connection manager.hoauth2Response as ByteStringihoauth2HTTP connection manager.hoauth2Response as ByteStringjhoauth2HTTP connection manager.hoauth2Response as ByteStringkhoauth2HTTP connection manager.hoauth2Response as ByteStringlhoauth2HTTP connection manager.hoauth2Response as ByteStringhoauth2Request to performhoauth2Modify request before sendinghoauth2HTTP connection manager.hoauth2Base URIhoauth2Authorized Access Tokenhoauth2Combined ResultZ[]\^_`abcdefghijkl^ab`_dcehijgflkZ[]\ Safe-Inferred "%&1;'ohoauth2)Authorization Code Grant Error Responses  3https://tools.ietf.org/html/rfc6749#section-4.1.2.1 I found hard time to figure a way to test the authorization error flow When anything wrong in  /authorize request, it will stuck at the Provider page hence no way for this library to parse error response. In other words,  /authorize ends up with 4xx or 5xx. Revisit this whenever find a case OAuth2 provider redirects back to Relying party with errors.whoauth2See xxhoauth2Prepare the authorization URL. Redirect to this URL asking for user interactive authentication. ovustqprwx ovustqprwx Safe-Inferred "%&1;' !"#$%&'-,+*()./01234;:98756<@?=>ABCDEFGHIJKLMNOPQRZ\[]^_`abcdefghijklwx(wx'-,+*)($&%!#" ./0123  Safe-Inferred"%&12;/u~hoauth2-Shall IdpApplication has a field of 'Idp a'??hoauth2 .https://www.rfc-editor.org/rfc/rfc6749#page-47hoauth2Each GrantTypeFlow has slightly different request parameter to /token endpoint.hoauth2Only 'AuthorizationCode flow (but not resource owner password nor client credentials) will use  in the token request create type family to be explicit on it. with 'type instance WithExchangeToken a b = b' implies no exchange token v.s. 'type instance WithExchangeToken a b = ExchangeToken -> b' implies needing an exchange tokenhoauth2Can be either "Client Secret" or JWT base on client authentication methodhoauth20Grant type query parameter has association with  but not completely strict. e.g. Both  and ' flow could support refresh token flow.hoauth2 2https://www.rfc-editor.org/rfc/rfc6749#section-4.1hoauth2 2https://www.rfc-editor.org/rfc/rfc6749#section-4.3hoauth2 2https://www.rfc-editor.org/rfc/rfc6749#section-4.4hoauth2 7https://www.rfc-editor.org/rfc/rfc7523.html#section-2.1hoauth2!FIXME: rename to ClientCredentialhoauth2Any parameter that required by your Idp and not mentioned in the OAuth2 spechoauth2Any parameter that required by your Idp and not mentioned in the OAuth2 spechoauth2Though technically one key can have multiple value in query, but who actually does it?!hoauth2+In order to reuse some methods from legacy Network.OAuth.OAuth2:. Will be removed when Experiment module becomes default.hoauth26An Application that supports "Authorization code" flowhoauth26An Application that supports "Authorization code" flowhoauth2 TODO: TBD}~ Safe-Inferred"%&1;0 }~~}                  ! " " # $ $ % & & ' ( ( ) * * + , - . / 0 1 2 3 4 56789:;<=>>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnop7:qr<stuvwxyz { | | } ~                                                                                                                             $hoauth2-2.8.1-9fUM7Kvqbi1LtlThmTyPbcNetwork.OAuth2.ExperimentNetwork.OAuth.OAuth2!Network.OAuth.OAuth2.TokenRequestNetwork.OAuth.OAuth2.HttpClient)Network.OAuth.OAuth2.AuthorizationRequestNetwork.OAuth2.Experiment.PkceNetwork.OAuth2.Experiment.Utils Paths_hoauth2Network.OAuth.OAuth2.InternalNetwork.OAuth2.Experiment.TypesPkceRequestParam codeVerifier codeChallengecodeChallengeMethodCodeChallengeMethodS256 CodeVerifierunCodeVerifier CodeChallengeunCodeChallenge mkPkceParam QueryParamsPostBodyClientAuthenticationMethodClientSecretBasicClientSecretPostClientAssertionJwt OAuth2Token accessToken refreshToken expiresIn tokenTypeidToken ExchangeTokenextokenIdTokenidtoken RefreshTokenrtoken AccessTokenatokenOAuth2oauth2ClientIdoauth2ClientSecretoauth2AuthorizeEndpointoauth2TokenEndpointoauth2RedirectUridefaultRequestHeadersappendQueryParams uriToRequest requestToUrihostLensportLensTokenRequestErrorCodeInvalidRequest InvalidClient InvalidGrantUnauthorizedClientUnsupportedGrantType InvalidScopeUnknownErrorCodeTokenRequestErrorerrorerrorDescriptionerrorUriparseTokeRequestErroraccessTokenUrlrefreshAccessTokenUrlfetchAccessTokenfetchAccessToken2fetchAccessTokenInternalfetchAccessTokenWithAuthMethodrefreshAccessTokenrefreshAccessToken2refreshAccessTokenInternal refreshAccessTokenWithAuthMethoddoJSONPostRequestdoSimplePostRequesthandleOAuth2TokenResponseparseResponseFlexibleparseResponseStringaddDefaultRequestHeadersclientSecretPost$fFromJSONTokenRequestErrorCode$fFromJSONTokenRequestError$fShowTokenRequestError$fEqTokenRequestError$fGenericTokenRequestError$fShowTokenRequestErrorCode$fEqTokenRequestErrorCodeAPIAuthenticationMethodAuthInRequestHeaderAuthInRequestBodyAuthInRequestQuery authGetJSONauthGetJSONInternalauthGetJSONWithAuthMethod authGetBS authGetBS2authGetBSInternalauthGetBSWithAuthMethod authPostJSONauthPostJSONInternalauthPostJSONWithAuthMethod authPostBS authPostBS2 authPostBS3authPostBSInternalauthPostBSWithAuthMethod$fEqAPIAuthenticationMethod$fOrdAPIAuthenticationMethodErrors AccessDeniedUnsupportedResponseType ServerErrorTemporarilyUnavailableauthorizationUrlauthorizationUrlWithParams$fFromJSONErrors $fShowErrors $fEqErrors$fGenericErrorsIdpApplicationIdp$sel:idpUserInfoEndpoint:Idp$sel:idpAuthorizeEndpoint:Idp$sel:idpTokenEndpoint:Idp$sel:idpFetchUserInfo:IdpHasUserInfoRequestconduitUserInfoRequest IdpUserInfoHasRefreshTokenRequestRefreshTokenRequestmkRefreshTokenRequestconduitRefreshTokenRequestHasPkceTokenRequestconduitPkceTokenRequestHasPkceAuthorizeRequestmkPkceAuthorizeRequestHasTokenRequest TokenRequestWithExchangeTokenmkTokenRequestconduitTokenRequestHasAuthorizeRequestAuthorizationRequestMkAuthorizationRequestResponsemkAuthorizeRequestParametermkAuthorizeRequest ToQueryParam toQueryParamPassword$sel:unPassword:PasswordUsername$sel:unUsername:UsernameAuthorizeState$$sel:unAuthorizeState:AuthorizeState RedirectUri$sel:unRedirectUri:RedirectUri ClientSecret $sel:unClientSecret:ClientSecretClientId$sel:unClientId:ClientIdScope$sel:unScope:ScopeGrantTypeValueGTAuthorizationCode GTPasswordGTClientCredentialsGTRefreshToken GTJwtBearerToResponseTypeValuetoResponseTypeValue GrantTypeFlowAuthorizationCodeResourceOwnerPasswordClientCredentials JwtBearerClientCredentialsIDPApplication3$sel:idpAppClientId:ClientCredentialsIDPApplication7$sel:idpAppClientSecret:ClientCredentialsIDPApplication$sel:idpAppTokenRequestAuthenticationMethod:ClientCredentialsIDPApplication/$sel:idpAppName:ClientCredentialsIDPApplication0$sel:idpAppScope:ClientCredentialsIDPApplication$sel:idpAppTokenRequestExtraParams:ClientCredentialsIDPApplication($sel:idp:ClientCredentialsIDPApplication#ResourceOwnerPasswordIDPApplication7$sel:idpAppClientId:ResourceOwnerPasswordIDPApplication;$sel:idpAppClientSecret:ResourceOwnerPasswordIDPApplication3$sel:idpAppName:ResourceOwnerPasswordIDPApplication4$sel:idpAppScope:ResourceOwnerPasswordIDPApplication7$sel:idpAppUserName:ResourceOwnerPasswordIDPApplication7$sel:idpAppPassword:ResourceOwnerPasswordIDPApplication$sel:idpAppTokenRequestExtraParams:ResourceOwnerPasswordIDPApplication,$sel:idp:ResourceOwnerPasswordIDPApplicationJwtBearerIdpApplication'$sel:idpAppName:JwtBearerIdpApplication&$sel:idpAppJwt:JwtBearerIdpApplication $sel:idp:JwtBearerIdpApplicationAuthorizationCodeIdpApplication/$sel:idpAppName:AuthorizationCodeIdpApplication3$sel:idpAppClientId:AuthorizationCodeIdpApplication7$sel:idpAppClientSecret:AuthorizationCodeIdpApplication0$sel:idpAppScope:AuthorizationCodeIdpApplication6$sel:idpAppRedirectUri:AuthorizationCodeIdpApplication9$sel:idpAppAuthorizeState:AuthorizationCodeIdpApplication?$sel:idpAppAuthorizeExtraParams:AuthorizationCodeIdpApplication$sel:idpAppTokenRequestAuthenticationMethod:AuthorizationCodeIdpApplication($sel:idp:AuthorizationCodeIdpApplicationtoResponseTypeParam toOAuth2KeytlToBS bs8ToLazyText mapsToParamsversiongetDataFileName getBinDir getLibDir getDynLibDir getDataDir getLibexecDir getSysconfDirbase GHC.MaybeMaybe$fFromJSONOAuth2Token authRequesthandleResponseupdateRequestHeaders setMethodappendAccessTokenaccessTokenToParamD:R:IdpApplicationJwtBeareri0%D:R:IdpApplicationAuthorizationCodei0-$fHasRefreshTokenRequestResourceOwnerPassword$AuthorizationCodeTokenRefreshRequest3$sel:grantType:AuthorizationCodeTokenRefreshRequest/$sel:scope:AuthorizationCodeTokenRefreshRequest6$sel:refreshToken:AuthorizationCodeTokenRefreshRequestPasswordRefreshTokenRequestAuthorizationCodeTokenRequest=$sel:clientAuthenticationMethod:ClientCredentialsTokenRequest2$sel:clientAssertion:ClientCredentialsTokenRequest6$sel:clientAssertionType:ClientCredentialsTokenRequest"$sel:password:PasswordTokenRequest"$sel:username:PasswordTokenRequest$$sel:assertion:JwtBearerTokenRequest,$sel:grantType:AuthorizationCodeTokenRequest$$sel:grantType:JwtBearerTokenRequest#$sel:grantType:PasswordTokenRequest,$sel:grantType:ClientCredentialsTokenRequest.$sel:redirectUri:AuthorizationCodeTokenRequest+$sel:clientId:AuthorizationCodeTokenRequest$sel:scope:PasswordTokenRequest($sel:scope:ClientCredentialsTokenRequest'$sel:code:AuthorizationCodeTokenRequestClientCredentialsTokenRequestPasswordTokenRequestJwtBearerTokenRequest%AuthorizationCodeAuthorizationRequest6$sel:redirectUri:AuthorizationCodeAuthorizationRequest3$sel:clientId:AuthorizationCodeAuthorizationRequest0$sel:scope:AuthorizationCodeAuthorizationRequest0$sel:state:AuthorizationCodeAuthorizationRequest