Module rich_authorization_requests 

Rich Authorization Requests (RAR) - RFC 9396

This module implements the Rich Authorization Requests (RAR) specification, enabling fine-grained authorization requests with detailed resource descriptions and complex permission structures.

Overview

RAR extends OAuth 2.0 authorization requests to include detailed, structured authorization details that specify exactly what resources and actions are being requested, providing much more granular control than traditional scopes.

Key Features

• Structured Authorization Details: Complex resource descriptions with actions and permissions
• Multi-Resource Requests: Single authorization request covering multiple resources
• Fine-Grained Permissions: Detailed access control beyond simple scopes
• Resource-Specific Data: Additional metadata and constraints per resource
• Privilege Escalation Control: Granular control over permission increases
• Dynamic Resource Discovery: Runtime resource identification and permission mapping

Authorization Detail Types

• Resource Access: File systems, databases, APIs, services
• Action Permissions: Read, write, delete, execute, manage
• Time-Based Access: Temporal restrictions and expiration
• Location-Based Access: Geographic or network-based restrictions
• Data-Specific Access: Field-level or record-level permissions

Usage Example

use auth_framework::server::rich_authorization_requests::*;
use auth_framework::server::SessionManager;
use std::sync::Arc;

// Initialize RAR manager
let config = RarConfig {
    max_authorization_details: 50,
    supported_types: vec![
        "file_access".to_string(),
        "api_access".to_string(),
        "database_access".to_string(),
    ],
    require_explicit_consent: true,
    ..Default::default()
};

let session_manager = Arc::new(SessionManager::new(Default::default()));
let rar_manager = RarManager::new(config, session_manager);

// Create complex authorization request
let auth_request = RarAuthorizationRequest {
    client_id: "app123".to_string(),
    response_type: "code".to_string(),
    authorization_details: vec![
        AuthorizationDetail {
            type_: "file_access".to_string(),
            actions: Some(vec!["read".to_string(), "write".to_string()]),
            locations: Some(vec!["https://files.example.com/docs/*".to_string()]),
            datatypes: Some(vec!["document".to_string(), "image".to_string()]),
            identifier: Some("project_files".to_string()),
            privileges: Some(vec!["editor".to_string()]),
            ..Default::default()
        }
    ],
    ..Default::default()
};

// Process authorization request
let result = rar_manager.process_authorization_request(auth_request, "user123").await?;

Structs

AuthorizationDetail

Authorization detail structure following RFC 9396

RarAuthorizationDecision

Authorization decision for RAR request

RarAuthorizationRequest

Rich Authorization Request following RFC 9396

RarConfig

Configuration for Rich Authorization Requests

RarDetailDecision

Decision for individual authorization detail

RarDiscoveredResource

Discovered resource information

RarManager

Main RAR manager

RarPermissionGrant

Permission grant summary

RarResourceAccess

Resource access grant

RarResourceDiscoveryRequest

Resource discovery request

RarResourceDiscoveryResponse

Resource discovery response

RarSessionAuthorizationContext

RAR session authorization context

RarSessionContext

RAR session context for authorization processing

RarValidationResult

Result of authorization detail validation

RarValidationRule

Validation rule for authorization details

Enums

RarCondition

Condition attached to authorization

RarDecisionType

Type of RAR authorization decision

RarRestriction

Access restriction

Traits

RarAuthorizationProcessor

RAR authorization request processor