authnz_common/types/tokens/
mpaat.rs

1//! MPAAT module.
2
3use serde::{Deserialize, Serialize};
4
5#[cfg(any(feature = "pqc-utils", feature = "ed25519-utils"))]
6use crate::{MResult, ServerError};
7
8#[derive(Deserialize, Serialize, PartialEq, Eq, Hash, Clone)]
9/// MPAAT header: unencrypted metadata to acquire the payload.
10pub struct MPAATHeader<U> {
11  /// C3A public key.
12  pub authnz_pkey: Vec<u8>,
13  /// Encryption nonce.
14  pub nonce: Vec<u8>,
15  #[serde(flatten)]
16  /// Common public fields (default MPAAT CPF for C3A worker is `DefaultCommonFields` with encryption key ID).
17  pub common_public_fields: Option<U>,
18}
19
20#[derive(Deserialize, Serialize, PartialEq, Eq, Hash, Clone)]
21/// MPAAT payload: encrypted user metadata.
22pub struct MPAATPayload<T> {
23  /// Client-side public key. May be empty if CBA is disabled.
24  pub cli_pkey: Vec<u8>,
25  /// Token expiration timestamp.
26  pub exp: chrono::DateTime<chrono::Utc>,
27  #[serde(flatten)]
28  /// Payload container (default MPAAT container for C3A worker is `DefaultWorkerPayload` with user ID hash, CBA requirement flag and authorized tags).
29  pub container: T,
30}
31
32#[derive(Deserialize, Serialize, PartialEq, Eq, Hash, Clone)]
33/// MPAAT signature: unencrypted signature of header and payload.
34pub struct MPAATSignature {
35  /// Ed25519 signature.
36  pub sig: Vec<u8>,
37}
38
39#[cfg(any(feature = "pqc-utils", feature = "ed25519-utils"))]
40impl<U: serde::Serialize> MPAATHeader<U> {
41  /// Signs MPAAT header and payload.
42  ///
43  /// Note that payload must be encrypted already.
44  pub fn sign_mpaat(&self, payload: &[u8], keypair: &crate::SignKeypair) -> MResult<Vec<u8>> {
45    let mut data = rmp_serde::to_vec(self).map_err(ServerError::from_private)?;
46    data.extend_from_slice(payload);
47    Ok(keypair.sign_raw(&data))
48  }
49}
authnz_common/types/tokens/mpaat.rs

authnz_common/types/tokens/
mpaat.rs
