Oauth — credentials/oauth

# Native OAuth client-credentials proxy. The exact allowed origin also applies
# to a returned instance_url. Matching expired-session 401s retry once using
# the same bounded request bytes; side-effecting requests can remain ambiguous.
# Put actual references, response markers and origins in private deployment config.
server: {addr: ":8080", max_body_bytes: 20971520, max_inflight_requests: 16}
credentials:
  sample_session:
    kind: oauth_client_credentials
    token_url: https://login.example.org/oauth/token
    allowed_origins: [https://api.example.org]
    client_id: {provider: env, name: SAMPLE_CLIENT_ID, refresh: 1m}
    client_secret: {provider: aws_secrets_manager, name: sample/session, json_field: client_secret, selection: exact, refresh: 1m}
    client_auth: form
    token_path: access_token
    instance_path: instance_url
    expiry_path: expires_in
    ttl: 5m
    timeout: 5s
    invalid_session: {path: "0.code", value: EXPIRED_SAMPLE_SESSION}
flows:
  session_proxy:
    nodes:
      - {id: in, type: http_trigger, path: "/proxy/session/{rest...}", methods: [GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS]}
      - {id: body, type: read_body, allow_empty: true, max_bytes: 20971520}
      - {id: auth, type: auth, scheme: exact, secret_ref: {provider: env, name: SAMPLE_INGRESS_TOKEN}, signature_header: X-Auth}
      - {id: env, type: envelope, body_format: raw}
      - id: up
        type: http_request
        url: "https://api.example.org/{rest}"
        credential: {profile: sample_session}
        header_mode: replace
        headers: {Content-Type: application/json, X-Sample-Options: sample}
        forward_method: true
        forward_query: true
        query_mode: last
        body_methods: [POST, PUT, PATCH]
        max_response_bytes: 20971520
      - {id: reply, type: respond, passthrough: true}
    edges: [in>body, body>auth, auth>env, env>up, up>reply]