feat(oauth2): allow a strategy to supply its own http_adapter

.formatter.exs

@@ -92,6 +92,7 @@ spark_locals_without_parens = [
   grace_period: 1,
   hash_provider: 1,
   hashed_password_field: 1,
+  http_adapter: 1,
   icon: 1,
   icon_url_field: 1,
   id: 1,

documentation/dsls/DSL-AshAuthentication.Strategy.Apple.md

@@ -71,6 +71,7 @@ The following defaults are applied:
 | [`auth_method`](#authentication-strategies-apple-auth_method){: #authentication-strategies-apple-auth_method } | `nil \| :client_secret_basic \| :client_secret_post \| :client_secret_jwt \| :private_key_jwt` | `:client_secret_post` | The authentication strategy used, optional. If not set, no authentication will be used during the access token request. |
 | [`client_secret`](#authentication-strategies-apple-client_secret){: #authentication-strategies-apple-client_secret } | `(any, any -> any) \| module \| String.t` |  | The OAuth2 client secret. Required if :auth_method is `:client_secret_basic`, `:client_secret_post` or `:client_secret_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`trusted_audiences`](#authentication-strategies-apple-trusted_audiences){: #authentication-strategies-apple-trusted_audiences } | `(any, any -> any) \| module \| list(any) \| nil` |  | A list of audiences which are trusted. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
+| [`http_adapter`](#authentication-strategies-apple-http_adapter){: #authentication-strategies-apple-http_adapter } | `atom \| {atom, keyword}` |  | The `Assent.HTTPAdapter` to use for this strategy's OAuth2 requests, as a module or `{module, opts}` tuple. Overrides the `:ash_authentication, :http_adapter` application default. Use this for a provider that needs bespoke transport handling — for example an adapter that unwraps a non-standard response envelope before the standard OAuth2 parsing runs. Defaults to the application setting (`Assent.HTTPAdapter.Finch`). |
 | [`private_key`](#authentication-strategies-apple-private_key){: #authentication-strategies-apple-private_key } | `(any, any -> any) \| module \| String.t` |  | The private key to use if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`code_verifier`](#authentication-strategies-apple-code_verifier){: #authentication-strategies-apple-code_verifier } | `boolean` | `false` | Boolean to generate and use a random 128 byte long url safe code verifier for PKCE flow, optional, defaults to false. When set to true the session params will contain :code_verifier, :code_challenge, and :code_challenge_method params |
 | [`registration_enabled?`](#authentication-strategies-apple-registration_enabled?){: #authentication-strategies-apple-registration_enabled? } | `boolean` | `true` | If enabled, new users will be able to register for your site when authenticating and not already present. If not, only existing users will be able to authenticate. |

documentation/dsls/DSL-AshAuthentication.Strategy.Auth0.md

@@ -69,6 +69,7 @@ The following defaults are applied:
 | [`auth_method`](#authentication-strategies-auth0-auth_method){: #authentication-strategies-auth0-auth_method } | `nil \| :client_secret_basic \| :client_secret_post \| :client_secret_jwt \| :private_key_jwt` | `:client_secret_post` | The authentication strategy used, optional. If not set, no authentication will be used during the access token request. |
 | [`client_secret`](#authentication-strategies-auth0-client_secret){: #authentication-strategies-auth0-client_secret } | `(any, any -> any) \| module \| String.t` |  | The OAuth2 client secret. Required if :auth_method is `:client_secret_basic`, `:client_secret_post` or `:client_secret_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`trusted_audiences`](#authentication-strategies-auth0-trusted_audiences){: #authentication-strategies-auth0-trusted_audiences } | `(any, any -> any) \| module \| list(any) \| nil` |  | A list of audiences which are trusted. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
+| [`http_adapter`](#authentication-strategies-auth0-http_adapter){: #authentication-strategies-auth0-http_adapter } | `atom \| {atom, keyword}` |  | The `Assent.HTTPAdapter` to use for this strategy's OAuth2 requests, as a module or `{module, opts}` tuple. Overrides the `:ash_authentication, :http_adapter` application default. Use this for a provider that needs bespoke transport handling — for example an adapter that unwraps a non-standard response envelope before the standard OAuth2 parsing runs. Defaults to the application setting (`Assent.HTTPAdapter.Finch`). |
 | [`private_key`](#authentication-strategies-auth0-private_key){: #authentication-strategies-auth0-private_key } | `(any, any -> any) \| module \| String.t` |  | The private key to use if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`private_key_id`](#authentication-strategies-auth0-private_key_id){: #authentication-strategies-auth0-private_key_id } | `(any, any -> any) \| module \| String.t` |  | The identifier of the private key (sent as `kid` in the JWT header) if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`private_key_path`](#authentication-strategies-auth0-private_key_path){: #authentication-strategies-auth0-private_key_path } | `(any, any -> any) \| module \| String.t` |  | Path to the private key PEM file (alternative to `:private_key`) if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |

documentation/dsls/DSL-AshAuthentication.Strategy.DynamicOidc.md

@@ -123,6 +123,7 @@ the strategy looks up the right row based on the request path
 | [`prevent_hijacking?`](#authentication-strategies-dynamic_oidc-prevent_hijacking?){: #authentication-strategies-dynamic_oidc-prevent_hijacking? } | `boolean` | `true` | Requires a confirmation add_on to be present if the password strategy is used with the same identity_field. |
 | [`auth_method`](#authentication-strategies-dynamic_oidc-auth_method){: #authentication-strategies-dynamic_oidc-auth_method } | `nil \| :client_secret_basic \| :client_secret_post \| :client_secret_jwt \| :private_key_jwt` | `:client_secret_post` | The authentication strategy used, optional. If not set, no authentication will be used during the access token request. |
 | [`trusted_audiences`](#authentication-strategies-dynamic_oidc-trusted_audiences){: #authentication-strategies-dynamic_oidc-trusted_audiences } | `(any, any -> any) \| module \| list(any) \| nil` |  | A list of audiences which are trusted. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
+| [`http_adapter`](#authentication-strategies-dynamic_oidc-http_adapter){: #authentication-strategies-dynamic_oidc-http_adapter } | `atom \| {atom, keyword}` |  | The `Assent.HTTPAdapter` to use for this strategy's OAuth2 requests, as a module or `{module, opts}` tuple. Overrides the `:ash_authentication, :http_adapter` application default. Use this for a provider that needs bespoke transport handling — for example an adapter that unwraps a non-standard response envelope before the standard OAuth2 parsing runs. Defaults to the application setting (`Assent.HTTPAdapter.Finch`). |
 | [`code_verifier`](#authentication-strategies-dynamic_oidc-code_verifier){: #authentication-strategies-dynamic_oidc-code_verifier } | `boolean` | `false` | Boolean to generate and use a random 128 byte long url safe code verifier for PKCE flow, optional, defaults to false. When set to true the session params will contain :code_verifier, :code_challenge, and :code_challenge_method params |
 | [`registration_enabled?`](#authentication-strategies-dynamic_oidc-registration_enabled?){: #authentication-strategies-dynamic_oidc-registration_enabled? } | `boolean` | `true` | If enabled, new users will be able to register for your site when authenticating and not already present. If not, only existing users will be able to authenticate. |
 | [`register_action_name`](#authentication-strategies-dynamic_oidc-register_action_name){: #authentication-strategies-dynamic_oidc-register_action_name } | `atom` |  | The name of the action to use to register a user, if `registration_enabled?` is `true`. Defaults to `register_with_<name>` See the "Registration and Sign-in" section of the strategy docs for more. |

documentation/dsls/DSL-AshAuthentication.Strategy.Github.md

@@ -72,6 +72,7 @@ The following defaults are applied:
 | [`authorize_url`](#authentication-strategies-github-authorize_url){: #authentication-strategies-github-authorize_url } | `(any, any -> any) \| module \| String.t` | `"https://github.com/login/oauth/authorize"` | The API url to the OAuth2 authorize endpoint, relative to `site`, e.g `authorize_url fn _, _ -> {:ok, "https://exampe.com/authorize"} end`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`token_url`](#authentication-strategies-github-token_url){: #authentication-strategies-github-token_url } | `(any, any -> any) \| module \| String.t` | `"https://github.com/login/oauth/access_token"` | The API url to access the token endpoint, relative to `site`, e.g `token_url fn _, _ -> {:ok, "https://example.com/oauth_token"} end`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`trusted_audiences`](#authentication-strategies-github-trusted_audiences){: #authentication-strategies-github-trusted_audiences } | `(any, any -> any) \| module \| list(any) \| nil` |  | A list of audiences which are trusted. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
+| [`http_adapter`](#authentication-strategies-github-http_adapter){: #authentication-strategies-github-http_adapter } | `atom \| {atom, keyword}` |  | The `Assent.HTTPAdapter` to use for this strategy's OAuth2 requests, as a module or `{module, opts}` tuple. Overrides the `:ash_authentication, :http_adapter` application default. Use this for a provider that needs bespoke transport handling — for example an adapter that unwraps a non-standard response envelope before the standard OAuth2 parsing runs. Defaults to the application setting (`Assent.HTTPAdapter.Finch`). |
 | [`user_url`](#authentication-strategies-github-user_url){: #authentication-strategies-github-user_url } | `(any, any -> any) \| module \| String.t` | `"/user"` | The API url to access the user endpoint, relative to `site`, e.g `user_url fn _, _ -> {:ok, "https://example.com/userinfo"} end`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`private_key`](#authentication-strategies-github-private_key){: #authentication-strategies-github-private_key } | `(any, any -> any) \| module \| String.t` |  | The private key to use if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`private_key_id`](#authentication-strategies-github-private_key_id){: #authentication-strategies-github-private_key_id } | `(any, any -> any) \| module \| String.t` |  | The identifier of the private key (sent as `kid` in the JWT header) if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |

documentation/dsls/DSL-AshAuthentication.Strategy.Google.md

@@ -72,6 +72,7 @@ The following defaults are applied:
 | [`auth_method`](#authentication-strategies-google-auth_method){: #authentication-strategies-google-auth_method } | `nil \| :client_secret_basic \| :client_secret_post \| :client_secret_jwt \| :private_key_jwt` | `:client_secret_post` | The authentication strategy used, optional. If not set, no authentication will be used during the access token request. |
 | [`client_secret`](#authentication-strategies-google-client_secret){: #authentication-strategies-google-client_secret } | `(any, any -> any) \| module \| String.t` |  | The OAuth2 client secret. Required if :auth_method is `:client_secret_basic`, `:client_secret_post` or `:client_secret_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`trusted_audiences`](#authentication-strategies-google-trusted_audiences){: #authentication-strategies-google-trusted_audiences } | `(any, any -> any) \| module \| list(any) \| nil` |  | A list of audiences which are trusted. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
+| [`http_adapter`](#authentication-strategies-google-http_adapter){: #authentication-strategies-google-http_adapter } | `atom \| {atom, keyword}` |  | The `Assent.HTTPAdapter` to use for this strategy's OAuth2 requests, as a module or `{module, opts}` tuple. Overrides the `:ash_authentication, :http_adapter` application default. Use this for a provider that needs bespoke transport handling — for example an adapter that unwraps a non-standard response envelope before the standard OAuth2 parsing runs. Defaults to the application setting (`Assent.HTTPAdapter.Finch`). |
 | [`private_key`](#authentication-strategies-google-private_key){: #authentication-strategies-google-private_key } | `(any, any -> any) \| module \| String.t` |  | The private key to use if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`private_key_id`](#authentication-strategies-google-private_key_id){: #authentication-strategies-google-private_key_id } | `(any, any -> any) \| module \| String.t` |  | The identifier of the private key (sent as `kid` in the JWT header) if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`private_key_path`](#authentication-strategies-google-private_key_path){: #authentication-strategies-google-private_key_path } | `(any, any -> any) \| module \| String.t` |  | Path to the private key PEM file (alternative to `:private_key`) if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |

documentation/dsls/DSL-AshAuthentication.Strategy.Microsoft.md

@@ -88,6 +88,7 @@ The following defaults are applied:
 | [`auth_method`](#authentication-strategies-microsoft-auth_method){: #authentication-strategies-microsoft-auth_method } | `nil \| :client_secret_basic \| :client_secret_post \| :client_secret_jwt \| :private_key_jwt` | `:client_secret_post` | The authentication strategy used, optional. If not set, no authentication will be used during the access token request. |
 | [`client_secret`](#authentication-strategies-microsoft-client_secret){: #authentication-strategies-microsoft-client_secret } | `(any, any -> any) \| module \| String.t` |  | The OAuth2 client secret. Required if :auth_method is `:client_secret_basic`, `:client_secret_post` or `:client_secret_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`trusted_audiences`](#authentication-strategies-microsoft-trusted_audiences){: #authentication-strategies-microsoft-trusted_audiences } | `(any, any -> any) \| module \| list(any) \| nil` |  | A list of audiences which are trusted. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
+| [`http_adapter`](#authentication-strategies-microsoft-http_adapter){: #authentication-strategies-microsoft-http_adapter } | `atom \| {atom, keyword}` |  | The `Assent.HTTPAdapter` to use for this strategy's OAuth2 requests, as a module or `{module, opts}` tuple. Overrides the `:ash_authentication, :http_adapter` application default. Use this for a provider that needs bespoke transport handling — for example an adapter that unwraps a non-standard response envelope before the standard OAuth2 parsing runs. Defaults to the application setting (`Assent.HTTPAdapter.Finch`). |
 | [`private_key`](#authentication-strategies-microsoft-private_key){: #authentication-strategies-microsoft-private_key } | `(any, any -> any) \| module \| String.t` |  | The private key to use if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`private_key_id`](#authentication-strategies-microsoft-private_key_id){: #authentication-strategies-microsoft-private_key_id } | `(any, any -> any) \| module \| String.t` |  | The identifier of the private key (sent as `kid` in the JWT header) if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |
 | [`private_key_path`](#authentication-strategies-microsoft-private_key_path){: #authentication-strategies-microsoft-private_key_path } | `(any, any -> any) \| module \| String.t` |  | Path to the private key PEM file (alternative to `:private_key`) if `:auth_method` is `:private_key_jwt`. Takes either a module which implements the `AshAuthentication.Secret` behaviour, a 2 arity anonymous function or a string. |