fiam_version: '0.2'
instance:
  id: specimen.oidc.authorization-code
  kind: specimen
  title: OIDC Authorization Code Flow
  status: provisional
  intent: Exercise multi-party choreography, browser-mediated redirects, token exchange, and layered identity semantics.
nodes:
- id: node.user-agent
  kind: system-node
  name: Browser
  node_type: fiam.node-type.user-agent
- id: node.relying-party
  kind: system-node
  name: Relying Party
  node_type: fiam.node-type.application
- id: node.authorization-server
  kind: system-node
  name: OpenID Provider
  node_type: fiam.node-type.identity-provider
ports:
- id: port.rp.authn
  owner: node.relying-party
  participations:
  - contract: contract.oidc
    mode: requires
    roles:
    - fiam.role.oidc-client
- id: port.op.authorization
  owner: node.authorization-server
  participations:
  - contract: contract.oidc
    mode: offers
    roles:
    - fiam.role.authorization-server
- id: port.op.token
  owner: node.authorization-server
  participations:
  - contract: contract.oidc
    mode: offers
    roles:
    - fiam.role.token-issuer
contracts:
- id: contract.oidc
  kind: interface-contract
  purpose:
  - fiam.purpose.authentication
  - fiam.purpose.identity-federation
  contract_forms:
  - fiam.contract-form.oidc
  operations:
  - id: operation.authorization-request
    name: authorization request
    interaction_style: fiam.interaction-style.redirect-request
  - id: operation.authorization-response
    name: authorization response
    interaction_style: fiam.interaction-style.redirect-response
  - id: operation.token-request
    name: token request
    interaction_style: fiam.interaction-style.request-response
endpoints:
- id: endpoint.authorization
  kind: endpoint
  address: https://idp.example.test/authorize
  address_scheme: fiam.address-scheme.https-url
- id: endpoint.token
  kind: endpoint
  address: https://idp.example.test/token
  address_scheme: fiam.address-scheme.https-url
bindings:
- id: binding.oidc.authorization-https
  contract: contract.oidc
  provider_port: port.op.authorization
  consumer_ports:
  - port.rp.authn
  operations:
  - operation.authorization-request
  - operation.authorization-response
  binding_profile: fiam.binding-profile.oidc-http
  communication_stack:
  - role: fiam.stack-role.identity-protocol
    term: fiam.protocol.openid-connect
  - role: fiam.stack-role.authorization-framework
    term: fiam.protocol.oauth2
  - role: fiam.stack-role.application-transfer-protocol
    term: fiam.protocol.http
  - role: fiam.stack-role.security-protocol
    term: fiam.protocol.tls
  - role: fiam.stack-role.transport
    term: fiam.transport.tcp
  endpoints:
  - endpoint.authorization
- id: binding.oidc.token-https
  contract: contract.oidc
  provider_port: port.op.token
  consumer_ports:
  - port.rp.authn
  operations:
  - operation.token-request
  binding_profile: fiam.binding-profile.oidc-http
  communication_stack:
  - role: fiam.stack-role.identity-protocol
    term: fiam.protocol.openid-connect
  - role: fiam.stack-role.authorization-framework
    term: fiam.protocol.oauth2
  - role: fiam.stack-role.application-transfer-protocol
    term: fiam.protocol.http
  - role: fiam.stack-role.security-protocol
    term: fiam.protocol.tls
  - role: fiam.stack-role.transport
    term: fiam.transport.tcp
  endpoints:
  - endpoint.token
interaction_flows:
- id: flow.oidc.authorization-code
  kind: interaction-flow
  flow_type: fiam.flow.authentication-choreography
  participants:
  - node.user-agent
  - node.relying-party
  - node.authorization-server
  steps:
  - sequence: 1
    operation: operation.authorization-request
    binding: binding.oidc.authorization-https
    from: node.relying-party
    via: node.user-agent
    to: node.authorization-server
  - sequence: 2
    operation: operation.authorization-response
    binding: binding.oidc.authorization-https
    from: node.authorization-server
    via: node.user-agent
    to: node.relying-party
  - sequence: 3
    operation: operation.token-request
    binding: binding.oidc.token-https
    from: node.relying-party
    to: node.authorization-server
security:
- id: security.oidc
  applies_to: flow.oidc.authorization-code
  authentication: fiam.security.authentication.federated
  credential_artifacts:
  - fiam.credential.authorization-code
  - fiam.credential.id-token
  - fiam.credential.access-token
  identity_propagation: fiam.security.identity-propagation.token
assertions:
- id: assertion.flow-required
  subject: flow.oidc.authorization-code
  predicate: fiam.property.multi-party
  value: true
  evidence:
    mode: fiam.evidence.declared
    source: OIDC protocol definition
    confidence: 1.0
  assertion_kind: property
  polarity: asserted
tests:
  stresses:
  - multi-party-choreography
  - browser-mediated-flow
  - identity-overlay
  notes:
  - Authentication is modeled as a flow, not collapsed into one endpoint.
  expected_properties:
  - id: check.evidence
    kind: all-assertions-have-evidence
  - id: check.no-deprecated
    kind: no-deprecated-terms
  - id: check.no-legacy-representations
    kind: no-legacy-representations