Module pkce 

PKCE Authorization Code flow for Cognito desktop login.

Flow (cloud-relayed callback — no loopback listener; see docs/specs/SPEC_MUXBUS_CLOUD_RELAYED_LOGIN_CALLBACK_2026_08_15.md):

1. Generate code_verifier + code_challenge (S256).
2. Register the flow’s state with the muxbus login relay.
3. Open browser to Cognito hosted UI; it redirects to the hosted /desktop-callback page, which posts {state, code} to the relay.
4. Poll the relay for the code (single-read on the relay side).
5. Exchange code for tokens via /oauth2/token (PKCE verifier never left this process).
6. Decode email from id_token claims (no re-verification needed — we fetched the token directly from Cognito).

Structs

PkceResult

Enums

RefreshTokenError

Typed so callers (the credential broker’s registered refresh closure) can distinguish “worth retrying” from “this refresh_token is dead, only a fresh login fixes it” without string-sniffing an error message. Rejected specifically means the token endpoint responded but rejected the request (Cognito’s invalid_grant-class 4xx for a revoked/expired refresh_token) — the credential itself is the problem. Network/ ParseFailed mean the ATTEMPT failed, not the credential.

Constants

LOGIN_TIMEOUT_SECS

Statics

ACTIVE_LOGIN 🔒

CANCELLED_IDS 🔒

NEXT_LOGIN_ID 🔒

Functions

cancel_active_login

Abort the in-flight login flow, if any. Returns false if there was none (a harmless no-op — the UI can call this without checking state first).

extract_jwt_claims 🔒

percent_encode 🔒

refresh_token

run_pkce_login

run_pkce_login_inner 🔒

token_sub 🔒

The sub claim of a Cognito token (unverified decode: this names the account a token we already hold belongs to, it doesn’t authenticate it). Empty if the token isn’t a JWT or has no sub.