Class MailboxAuthorizer
- Namespace
- MailFathom.Common.MailboxOAuth
- Assembly
- MailFathom.Common.dll
Runs the one-time, operator-driven exchange that produces a mailbox refresh token.
public sealed class MailboxAuthorizer- Inheritance
-
MailboxAuthorizer
- Inherited Members
Remarks
This is deliberately not part of the running service. The host is headless, ships in a container, and authenticates with a refresh token it was given; obtaining that token needs a person to sign in, which is an administration act with its own lifetime. Keeping it in a separate executable is what lets the host serve no consent page, own no redirect endpoint, and hold no authorization-server credential it does not need at run time.
Two grants reach a person, and which one is available is the provider's decision rather than a preference: Microsoft Entra issues device codes for the IMAP scopes, while Google's device flow is restricted to a scope list that contains no mail scope at all, so a Google mailbox has to go through the authorization-code grant. Both paths end at the same token endpoint and both are bound by PKCE where the grant allows it.
Constructors
- MailboxAuthorizer(HttpClient, TimeProvider)
Initializes an authorizer over a transport and a clock.
Methods
- AuthorizeWithDeviceCodeAsync(MailboxAuthorizationRequest, Action<DeviceCodePrompt>, CancellationToken)
Requests a device code, reports the prompt, and polls until the person completes the sign-in.
- BuildAuthorization(MailboxAuthorizationRequest)
Builds the address a person opens to authorize the mailbox, and the proof the code is redeemed with.
- RedeemAuthorizationCodeAsync(MailboxAuthorizationRequest, PendingAuthorization, string, CancellationToken)
Exchanges an authorization code the operator pasted back for a refresh token.