| AuthorizationCodeBuilder | Builds the code response-type component of an authorization endpoint success response — the Authorization Code Flow contributor. Generates an authorization code via IAuthorizationCodeService and stores it on the running SuccessfullyAuthenticated result. Registered by default through AddAuthorizationEndpoint(); covers the OAuth 2.1 (draft) recommended flow. Declares authorization_code in GrantTypesSupported so the discovery endpoint and registration-time gates aggregate it transparently. |
| AuthorizationEndpointMetadataFactory | Builds the AuthorizationEndpointMetadata advertised in discovery from the registered set of IAuthorizationResponseBuilder: each builder declares the response-type it owns, and the supported response-type combinations are the canonical OAuth/OIDC combos fully covered by the registered builders. Kept off the request-handling path so the discovery endpoint does not resolve the authorization handler (and its request-time dependencies, such as the JARM response encoder) merely to read this metadata. |
| AuthorizationHandler | Handles authorization requests by fetching, validating, processing and encoding the response. |
| AuthorizationRequestProcessor | Processes authorization requests by coordinating with various services like authentication, consent, and token issuance. This class handles the logic of determining the appropriate response to an authorization request based on the request's parameters and the current state of the user's session. |
| AuthorizationRequestValidator | Implements the Chain of Responsibility design pattern for processing authorization requests. This class delegates the validation of authorization requests to an IAuthorizationContextValidator, allowing a sequence of validators to handle the request in a decoupled manner. Each validator in the chain processes the request and potentially passes it along to the next validator. |
| AuthorizationResponseEncoder | Default IAuthorizationResponseEncoder. Applies the iss (RFC 9207) and implicit/hybrid scope gating, and — for a JARM (*.jwt) response mode — packs the response parameters into a signed/encrypted response JWT and resolves the delivery mode. Mutates the response in place; the transport layer only maps the encoded response onto the wire. |
| ConsentConstraintEnforcer | Default IConsentConstraintEnforcer. Asserts granted ⊆ requested for scopes, resources (including their nested scopes) and RFC 9396 authorization_details, throwing when the consent provider returned anything outside the request. |