canic_core/dto/auth/
token.rs

1//! Module: dto::auth::token
2//!
3//! Responsibility: delegated token request, response, and bearer token DTOs.
4//! Does not own: token issuance, replay checks, or proof verification.
5//! Boundary: passive issuer/client token transport contracts.
6
7use super::{
8    AuthRequestMetadata, DelegatedRoleGrant, DelegationAudience, DelegationProof, IssuerProof,
9};
10use crate::dto::prelude::*;
11
12//
13// DelegatedTokenClaims
14//
15
16#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
17pub struct DelegatedTokenClaims {
18    pub subject: Principal,
19    pub issuer_pid: Principal,
20    pub cert_hash: [u8; 32],
21    pub issued_at_ns: u64,
22    pub expires_at_ns: u64,
23    pub aud: DelegationAudience,
24    pub grants: Vec<DelegatedRoleGrant>,
25    pub nonce: [u8; 16],
26    #[serde(default)]
27    pub ext: Option<Vec<u8>>,
28}
29
30//
31// DelegatedToken
32//
33
34#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
35pub struct DelegatedToken {
36    pub claims: DelegatedTokenClaims,
37    pub proof: DelegationProof,
38    pub issuer_proof: IssuerProof,
39}
40
41//
42// DelegatedTokenPrepareRequest
43//
44
45#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
46pub struct DelegatedTokenPrepareRequest {
47    #[serde(default)]
48    pub metadata: Option<AuthRequestMetadata>,
49    pub subject: Principal,
50    pub aud: DelegationAudience,
51    pub grants: Vec<DelegatedRoleGrant>,
52    pub ttl_ns: u64,
53    #[serde(default)]
54    pub ext: Option<Vec<u8>>,
55}
56
57//
58// DelegatedTokenPrepareResponse
59//
60
61#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
62pub struct DelegatedTokenPrepareResponse {
63    pub claims: DelegatedTokenClaims,
64    pub claims_hash: [u8; 32],
65    pub retrieval_expires_at_ns: u64,
66}
67
68//
69// DelegatedTokenGetRequest
70//
71
72#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
73pub struct DelegatedTokenGetRequest {
74    pub claims_hash: [u8; 32],
75}
canic_core/dto/auth/token.rs

canic_core/dto/auth/
token.rs
