Overview - EasyAF.AI

Types

Classes

Name	Summary
AuthorizationCodePkceGrant	Runs the RFC 6749 authorization code grant with RFC 7636 PKCE over an RFC 8252 loopback redirect: build the authorization URL with an `S256` challenge and a bound `state`, then exchange the returned code — after the RFC 9207 `iss` check — for a token.
AuthorizationServerMetadata	The RFC 8414 authorization server metadata document, or its OpenID Connect discovery document counterpart, restricted to the endpoints, advertised grants and scopes, and PKCE / dynamic client registration capability flags outbound OAuth discovery actually reads.
AuthorizationServerMetadataClient	Discovers an RFC 8414 authorization server metadata document (or its OpenID Connect discovery document counterpart) over the handler-free `"OAuth"` named HttpClient, probing the well-known candidates for a base URI in the order that prefers a Microsoft identity platform v2 document over its v1 counterpart.
ClientCredentialsGrant	Runs the RFC 6749 section 4.4 client credentials grant: a confidential client presents its own identifier and secret and receives an access token, with no end user and no elicitation anywhere in the path.
DeviceAuthorizationResponse	The RFC 8628 section 3.2 device authorization response returned from a device authorization endpoint.
DeviceCodeGrant	Runs the RFC 8628 device authorization grant: start the grant at the device authorization endpoint, then poll the token endpoint honoring `interval`, `slow_down`, and `authorization_pending` until a token is issued, the code expires, or the end user denies it.
DynamicClientRegistrar	Registers this process as an OAuth client at an authorization server’s RFC 7591 `registration_endpoint`, so an operator who has no pre-registered application can still sign in.
DynamicClientRegistrationRequest	The RFC 7591 section 2 client metadata document DynamicClientRegistrar POSTs to an authorization server’s `registration_endpoint`.
FileIdTokenCallback	Supplies the enterprise OpenID Connect id token the identity assertion grant exchanges, reading it from the file `--idp-id-token-file` names or from the ODataMcpAuthConstants.IdTokenEnvironmentVariable environment variable.
GrantSelector	Selects the OutboundGrantKind outbound OAuth runs for a remote OData service, per step 6 of the discovery algorithm: an operator override when advertised and implemented, else enterprise identity assertion, else non-interactive client credentials, else the interactive default of device code falling back to authorization code.
LatchkeyTokenCache	The durable, single-slot SDK `ITokenCache` for outbound OAuth, backed by the operating system credential store through Latchkey so a restart of the same service root and client id does not re-prompt the operator.
LoopbackAuthorizationCallback	The RFC 8252 loopback redirect endpoint the authorization code grant hands to the authorization server: an HttpListener bound to `http://127.0.0.1:{ephemeral}/callback/` that accepts exactly one authorization response, binds it to the expected `state`, and hands back the SDK `AuthorizationResult`.
OAuthChallenge	One parsed `WWW-Authenticate` challenge: the authentication scheme, the OAuth-relevant auth-params promoted to typed properties, and the complete, case-insensitive parameter set exactly as it arrived.
OAuthConsentRequiredException	Thrown when interactive sign-in is required to complete an outbound OAuth grant and OutboundOAuthOptions.ConsentPresenter is `null` — the mid-session path, where the caller (an MCP tool invocation) must elicit the operator instead of blocking on stderr.
OAuthDiscovery	Runs steps 3 through 5 and 8b of the outbound OAuth discovery algorithm: parse the `WWW-Authenticate` challenge, fetch RFC 9728 protected resource metadata, select an authorization server from every candidate base the challenge and that metadata imply, and resolve the RFC 8707 resource indicator.
OAuthDiscoveryResult	Everything the outbound OAuth discovery algorithm learned about a protected OData service: the `WWW-Authenticate` challenge it started from, the RFC 9728 protected resource metadata it found (if any), the authorization server it selected, and the grants, scope, and RFC 8707 resource a grant needs.
OAuthErrorPayload	The RFC 6749 section 5.2 error response returned from a token, device authorization, or dynamic client registration endpoint.
OAuthTokenException	The single exception type an outbound token, device authorization, or polling request throws when the authorization server answers with an RFC 6749 section 5.2 error payload, or when the request never reached one.
ODataMcpAuthConstants	Protocol identifiers for outbound OAuth: header and scheme names, well-known suffixes, grant type identifiers, wire parameter and error names, and the named `HttpClient`s and Latchkey service name outbound OAuth wires into DI.
ODataOutboundAuthHandler	The `"OData"` named client’s delegating handler: it attaches whatever credential the operator configured, and when none was configured it drives OutboundOAuthClient through the send path — attach a still-valid token, refresh one that has fallen inside the skew, or run a grant off the challenge the resource answered with.
OutboundAuthLogRedactor	Masks token and credential values out of text before it reaches a log sink, per `specs/v3/AUTHENTICATION.md` “Observability -> Redaction” and “Security & Privacy -> Logging tokens”.
OutboundConsentRequest	The consent-request payload passed to OutboundOAuthOptions.ConsentPresenter, and carried by OAuthConsentRequiredException, when interactive sign-in is required to complete an outbound OAuth grant.
OutboundDiscoveryException	The single exception type outbound discovery throws when a well-known request fails in a way that `AUTH-14` does not treat as a non-fatal fallback: a timeout, a transport failure, or a repeated server error after the one retry discovery allows.
OutboundGrantKind	The OAuth 2.0 grant kinds outbound OAuth can select for a remote OData service.
OutboundGrantKindParser	Parses and formats the CLI `--grant` wire names for OutboundGrantKind.
OutboundOAuthClient	The outbound OAuth state machine: it owns one OData service root’s cached token, decides whether that token can still be attached, refreshes it exactly once when several callers race, and runs the advertised grant when there is nothing left to refresh.
OutboundOAuthOptions	Operator-supplied and discovered outbound OAuth settings for a single remote OData service — the options CLI hop 2 (`ODataOutboundAuthHandler`, `OutboundOAuthClient`, and the grant classes) runs on.
ProtectedResourceMetadataClient	Fetches an RFC 9728 protected resource metadata document over the handler-free `"OAuth"` named HttpClient, treating every well-known failure per `AUTH-14`: 401, 403, 404, and a failed parse are logged and swallowed; a timeout or 5xx is retried once before it becomes fatal.
RefreshTokenGrant	Runs the RFC 6749 section 6 refresh token grant: exchange the refresh token on a cached `TokenContainer` for a fresh access token, preserving rotation and the client and server identity the container already carried.
ScopeResolver	Resolves the space-delimited OAuth `scope` a token request should ask for, per step 8 of the discovery algorithm and matching the SDK 2.2 `ScopeSelectorDelegate` order exactly.
TokenEndpointClient	Posts an RFC 6749 token request on the handler-free `"OAuth"` named HttpClient and turns the answer into either a TokenEndpointResponse or an OAuthTokenException. Every grant in this package — device code, refresh, authorization code, client credentials — sends its token request through this one class.
TokenEndpointResponse	The RFC 6749 section 5.1 successful token response returned from a token endpoint.
WwwAuthenticateParser	Parses `WWW-Authenticate` response header values into OAuthChallenge instances using the RFC 9110 section 11.6.1 challenge grammar and the RFC 6750 / RFC 9728 OAuth auth-params.

Enums

Name	Summary
OutboundGrantKind	The OAuth 2.0 grant kinds outbound OAuth can select for a remote OData service.