d-OAuth-Client/crates/web/index.html

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1" />
    <meta name="color-scheme" content="dark light" />
    <meta
      name="description"
      content="A confidential BFF runs the OAuth 2.1 flow - PKCE, PAR, DPoP - while this WASM page renders the identity, scopes, and token metadata that come back."
    />
    <meta name="theme-color" content="#141821" />
    <!-- The crate has both a lib (host-testable) and a bin target, so pin the
         Trunk artifact explicitly; `web-app` names the bin in Cargo.toml. -->
    <link data-trunk rel="rust" data-bin="web-app" />
    <!-- External CSP-safe autoloader: `inject_scripts = false` (Trunk.toml)
         leaves no inline `<script type="module">` for the BFF's strict
         `script-src 'self' 'wasm-unsafe-eval'` to block; this same-origin
         module imports the stable `web-app.js`/`web-app_bg.wasm` artifacts
         and calls `init()`. -->
    <link data-trunk rel="copy-file" href="bootstrap.js" />
    <script type="module" src="/bootstrap.js"></script>
    <link data-trunk rel="tailwind-css" href="style/input.css" />
    <title>OAuth 2.1 Client - sender-constrained sign-in</title>
  </head>
  <body>
    <noscript>
      <p class="p-6 font-sans text-sm">
        This demo is a WebAssembly application and needs JavaScript enabled.
      </p>
    </noscript>
  </body>
</html>