Provider adapters and compatibility boundary

triangle/oauth · AGPL-3.0-or-later

The entry class is Triangle\OAuth, not Triangle\OAuth\OAuth. It takes an array or config-file path plus optional StorageInterface and Monolog logger. authenticate(name) obtains an adapter and either returns an authentication redirect response or the connected adapter. getAdapter, getProviderConfig, isConnectedWith, getProviders, getConnectedProviders, getConnectedAdapters and disconnectAllAdapters manage provider state.

Configuration uses a callback URI and named providers with enabled, adapter and keys entries. Use exact registered HTTPS callback URIs and provider credentials from secret storage. Session storage and the configured HTTP client must be present; a provider name in the source is not proof of a currently supported external OAuth API.

The reviewed source imports Triangle\Http\Response, which is not declared by the current HTTP engine; its support request/response aliases use Triangle\Request / Engine response instead. The Composer development dependency also names triangle/http, whereas the Web scaffold uses triangle/engine-http. Resolve and test this compatibility before promising a copy/paste login example.

Provider OAuth login and MIX ID’s OAuth authorization server are separate products. Do not infer PKCE/state/nonce/token validation from a successful redirect. Review each adapter’s callback binding, one-time state, replay resistance and token verification. Scope credentials minimally and never log provider tokens. Full external-provider login tests are not claimed.

Direct dependencies

Package	Constraint
php	^8.2
ext-mbstring	*
ext-json	*
ext-curl	*
localzet/http	^2.0

Pinned source · 6d49f02cb864.