An authorization challenge: what a WWW-Authenticate header says, on
either side of a request.
A client reads it from a response with parse/1 (Sake.Client hands
it back in {:error, {:unauthorized, challenge}} and
{:error, {:insufficient_scope, challenge}}): the scheme, the
resource_metadata URL (RFC 9728), the error, its
error_description, the realm and the scope. nonce is the
response's DPoP-Nonce header (RFC 9449 §9), which a use_dpop_nonce
error asks the next proof to carry. An insufficient_user_authentication
error (RFC 9470) says how the person must sign in: acr_values, the
authentication context classes any one of which will do, and max_age,
in seconds, how recently (Sake.Client hands it back in
{:error, {:insufficient_user_authentication, challenge}}).
A resource refuses a request with one: status is the HTTP status
(401, or 403 for insufficient_scope), www_authenticate the header
values to send, in order, and nonce the DPoP-Nonce to send with
them, if any. Sake.Plug turns it into the response.
Summary
Types
@type t() :: %Sake.Auth.Challenge{ acr_values: [String.t()], error: String.t() | nil, error_description: String.t() | nil, max_age: non_neg_integer() | nil, nonce: String.t() | nil, realm: String.t() | nil, resource_metadata: String.t() | nil, scheme: String.t() | nil, scope: [String.t()], status: 401 | 403 | nil, www_authenticate: [String.t()] }