Struct GnapService 

pub struct GnapService { /* private fields */ }

Implementations

impl GnapService

pub fn new(config: GnapConfig) -> Self

pub fn verify_jwk_signature( jwk: &GnapJwk, message: &[u8], signature: &[u8], ) -> Result<()>

Reconstruct the raw public key bytes from a JWK and verify a signature using ring. Supports ES256 (P-256) and RS256.

This is called by middleware or application code that extracts the HTTP message signature from the request before invoking the GNAP transaction endpoints.

pub fn validate_client_key_with_proof( client: &Option<GnapClientInfo>, proof_message: Option<&[u8]>, proof_signature: Option<&[u8]>, ) -> Result<Option<String>>

Validate the client key binding on a request. Returns the key thumbprint if a key is present and valid.

When proof_message and proof_signature are provided, the actual cryptographic signature is verified against the client’s JWK. For proof methods other than “test”, the caller (typically HTTP middleware) must extract and supply the message and signature bytes from the request (e.g. the HTTP Signature input string and its signature value).

pub async fn handle_transaction( &self, request: GnapTransactionRequest, ) -> Result<Value>

Handle a new GNAP transaction request (draft-ietf-gnap-core-protocol §2)

pub async fn continue_transaction( &self, transaction_id: &str, continue_token: &str, interact_ref: Option<&str>, interact_hash: Option<&str>, ) -> Result<Value>

Continue a GNAP transaction (polling or post-interaction).

The continuation token is rotated on every successful call per draft §5.1, preventing replay of old continuation responses.

pub async fn approve_transaction( &self, transaction_id: &str, subject_id: Option<&str>, ) -> Result<()>

Approve a pending transaction (called after user interaction). Optionally sets the subject identifier for subject-info responses.

pub async fn deny_transaction(&self, transaction_id: &str) -> Result<()>

Deny a pending transaction

pub async fn revoke_token(&self, token_value: &str) -> Result<()>

Revoke an issued access token (draft §6.2 — DELETE on manage URI).

pub async fn rotate_token(&self, old_token_value: &str) -> Result<Value>

Rotate an issued access token (draft §6.1 — POST on manage URI). Returns a new token with the same access rights and key binding.

pub async fn introspect_token(&self, token_value: &str) -> Result<Option<Value>>

Introspect a token — check if it is valid and return its access rights.

pub async fn validate_token_key_binding( &self, token_value: &str, presenting_jwk: &GnapJwk, ) -> Result<bool>

Validate that a key-bound token is being used with the correct key.

For tokens issued with a client key binding, verify that the presenting client’s JWK thumbprint matches the stored binding. Returns Ok(true) if the token is not key-bound (no restriction).

pub async fn cleanup_expired_transactions(&self)

Remove expired transactions from the in-memory store.

pub async fn cleanup_expired_tokens(&self)

Remove expired access tokens from the in-memory store.