@spec authorize(
  params :: [
    scope: String.t(),
    against: %{
      optional(:client) => %Boruta.Oauth.Client{
        access_token_ttl: term(),
        authorization_code_ttl: term(),
        authorize_scope: term(),
        authorized_scopes: term(),
        confidential: term(),
        id: term(),
        id_token_kid: term(),
        id_token_signature_alg: term(),
        id_token_ttl: term(),
        jwks_uri: term(),
        jwt_public_key: term(),
        logo_uri: term(),
        metadata: term(),
        name: term(),
        pkce: term(),
        private_key: term(),
        public_key: term(),
        public_refresh_token: term(),
        public_revoke: term(),
        redirect_uris: term(),
        refresh_token_ttl: term(),
        secret: term(),
        supported_grant_types: term(),
        token_endpoint_auth_methods: term(),
        token_endpoint_jwt_auth_alg: term(),
        userinfo_signed_response_alg: term()
      },
      optional(:resource_owner) => struct(),
      optional(:token) => %Boruta.Oauth.Token{
        client: term(),
        code_challenge: term(),
        code_challenge_hash: term(),
        code_challenge_method: term(),
        expires_at: term(),
        inserted_at: term(),
        nonce: term(),
        redirect_uri: term(),
        refresh_token: term(),
        refresh_token_revoked_at: term(),
        resource_owner: term(),
        revoked_at: term(),
        scope: term(),
        state: term(),
        sub: term(),
        type: term(),
        value: term()
      }
    }
  ]
) :: {:ok, scope :: String.t()} | {:error, Boruta.Oauth.Error.t()}