class OAuth2::Authenticator

def self.encode_basic_auth(user, password) 

def self.encode_basic_auth(user, password)
  "Basic #{Base64.strict_encode64("#{user}:#{password}")}"
end

def apply(params)

Returns:
  • (Hash) - params amended with appropriate authentication details

Parameters:
  • params (Hash) -- a Hash of params for the token endpoint 
def apply(params)
  case mode.to_sym
  when :basic_auth
    apply_basic_auth(params)
  when :request_body
    apply_params_auth(params)
  when :tls_client_auth
    apply_client_id(params)
  when :private_key_jwt
    params
  else
    raise NotImplementedError
  end
end

def apply_basic_auth(params)

it is not already set in the params.
Adds an `Authorization` header with Basic Auth credentials if and only if 
def apply_basic_auth(params)
  headers = params.fetch(:headers, {})
  headers = basic_auth_header.merge(headers)
  params.merge(headers: headers)
end

def apply_client_id(params)

we don't want to send the secret
When using schemes that don't require the client_secret to be passed i.e TLS Client Auth, 
def apply_client_id(params)
  result = {}
  result['client_id'] = id unless id.nil?
  result.merge(params)
end

def apply_params_auth(params)

already set.
Adds client_id and client_secret request parameters if they are not 
def apply_params_auth(params)
  result = {}
  result['client_id'] = id unless id.nil?
  result['client_secret'] = secret unless secret.nil?
  result.merge(params)
end

def basic_auth_header

Other tags:
    See: https://datatracker.ietf.org/doc/html/rfc2617#section-2 - 
def basic_auth_header
  {'Authorization' => self.class.encode_basic_auth(id, secret)}
end

def initialize(id, secret, mode) 

def initialize(id, secret, mode)
  @id = id
  @secret = secret
  @mode = mode
end