Struct Permission 

pub struct Permission { /* private fields */ }

Represents a permission from JWT claims. Serializes to format: "{tenant_id}:{resource_pattern}:{resource_id}:{action}" where tenant_id and resource_id are “*” if None. This is compatible with modkit_security::Permission.

Implementations

impl Permission

pub fn builder() -> PermissionBuilder

Examples found in repository

examples/dispatcher_usage.rs (line 72)

    fn normalize(&self, raw: &Value) -> Result<Claims, ClaimsError> {
        let issuer_value = raw
            .get("iss")
            .ok_or_else(|| ClaimsError::MissingClaim("iss".to_owned()))?;
        let issuer = extract_string(issuer_value, "iss")?;

        let sub_value = raw
            .get("sub")
            .ok_or_else(|| ClaimsError::MissingClaim("sub".to_owned()))?;
        let subject = parse_uuid_from_value(sub_value, "sub")?;

        let audiences = raw.get("aud").map(extract_audiences).unwrap_or_default();

        let expires_at = raw
            .get("exp")
            .map(|value| parse_timestamp(value, "exp"))
            .transpose()?;

        let not_before = raw
            .get("nbf")
            .map(|value| parse_timestamp(value, "nbf"))
            .transpose()?;

        let issued_at = raw
            .get("iat")
            .map(|value| parse_timestamp(value, "iat"))
            .transpose()?;

        let jwt_id = raw
            .get("jti")
            .and_then(|v| v.as_str())
            .map(ToString::to_string);

        let tenant_id_value = raw
            .get("tenant_id")
            .ok_or_else(|| ClaimsError::MissingClaim("tenant_id".to_owned()))?;
        let tenant_id = parse_uuid_from_value(tenant_id_value, "tenant_id")?;

        let permissions: Vec<Permission> = raw
            .get("roles")
            .and_then(Value::as_array)
            .map(|arr| {
                arr.iter()
                    .filter_map(|value| value.as_str())
                    .filter_map(|role| {
                        if let Some(pos) = role.rfind(':') {
                            Permission::builder()
                                .resource_pattern(&role[..pos])
                                .action(&role[pos + 1..])
                                .build()
                                .ok()
                        } else {
                            Permission::builder()
                                .resource_pattern(role)
                                .action("*")
                                .build()
                                .ok()
                        }
                    })
                    .collect()
            })
            .unwrap_or_default();

        Ok(Claims {
            issuer,
            subject,
            audiences,
            expires_at,
            not_before,
            issued_at,
            jwt_id,
            tenant_id,
            permissions,
            extras: serde_json::Map::new(),
        })
    }

pub fn tenant_id(&self) -> Option<Uuid>

pub fn resource_pattern(&self) -> &str

Examples found in repository

examples/dispatcher_usage.rs (line 181)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut plugins = PluginRegistry::default();
    plugins.register("demo", Arc::new(DemoClaimsPlugin));

    let mut plugin_configs = HashMap::new();
    plugin_configs.insert(
        "demo".to_owned(),
        PluginConfig::Oidc {
            tenant_claim: "tenants".to_owned(),
            roles_claim: "roles".to_owned(),
        },
    );

    let config = AuthConfig {
        mode: AuthModeConfig {
            provider: "demo".to_owned(),
        },
        issuers: vec!["https://issuer.local".to_owned()],
        audiences: vec!["demo-api".to_owned()],
        plugins: plugin_configs,
        ..AuthConfig::default()
    };

    let validation = ValidationConfig {
        allowed_issuers: config.issuers.clone(),
        allowed_audiences: config.audiences.clone(),
        leeway_seconds: config.leeway_seconds,
        require_uuid_subject: true,
        require_uuid_tenants: true,
    };

    let subject = Uuid::new_v4();
    let tenant = Uuid::new_v4();
    let expires_at = OffsetDateTime::now_utc() + Duration::minutes(15);

    let raw_claims = serde_json::json!({
        "iss": "https://issuer.local",
        "sub": subject.to_string(),
        "aud": ["demo-api"],
        "exp": expires_at.unix_timestamp(),
        "tenant_id": tenant.to_string(),
        "roles": ["viewer:read"]
    });

    let dispatcher = AuthDispatcher::new(validation, &config, &plugins)?
        .with_key_provider(Arc::new(StaticKeyProvider::new(raw_claims)));

    let claims = dispatcher.validate_jwt("demo-token").await?;
    let perm_list = if claims.permissions.is_empty() {
        "none".to_owned()
    } else {
        claims
            .permissions
            .iter()
            .map(|p| format!("{}:{}", p.resource_pattern(), p.action()))
            .collect::<Vec<_>>()
            .join(", ")
    };
    println!(
        "Validated token for subject {} with permissions {}",
        claims.subject, perm_list
    );

    Ok(())
}

pub fn resource_id(&self) -> Option<Uuid>

pub fn action(&self) -> &str

Examples found in repository

examples/dispatcher_usage.rs (line 181)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut plugins = PluginRegistry::default();
    plugins.register("demo", Arc::new(DemoClaimsPlugin));

    let mut plugin_configs = HashMap::new();
    plugin_configs.insert(
        "demo".to_owned(),
        PluginConfig::Oidc {
            tenant_claim: "tenants".to_owned(),
            roles_claim: "roles".to_owned(),
        },
    );

    let config = AuthConfig {
        mode: AuthModeConfig {
            provider: "demo".to_owned(),
        },
        issuers: vec!["https://issuer.local".to_owned()],
        audiences: vec!["demo-api".to_owned()],
        plugins: plugin_configs,
        ..AuthConfig::default()
    };

    let validation = ValidationConfig {
        allowed_issuers: config.issuers.clone(),
        allowed_audiences: config.audiences.clone(),
        leeway_seconds: config.leeway_seconds,
        require_uuid_subject: true,
        require_uuid_tenants: true,
    };

    let subject = Uuid::new_v4();
    let tenant = Uuid::new_v4();
    let expires_at = OffsetDateTime::now_utc() + Duration::minutes(15);

    let raw_claims = serde_json::json!({
        "iss": "https://issuer.local",
        "sub": subject.to_string(),
        "aud": ["demo-api"],
        "exp": expires_at.unix_timestamp(),
        "tenant_id": tenant.to_string(),
        "roles": ["viewer:read"]
    });

    let dispatcher = AuthDispatcher::new(validation, &config, &plugins)?
        .with_key_provider(Arc::new(StaticKeyProvider::new(raw_claims)));

    let claims = dispatcher.validate_jwt("demo-token").await?;
    let perm_list = if claims.permissions.is_empty() {
        "none".to_owned()
    } else {
        claims
            .permissions
            .iter()
            .map(|p| format!("{}:{}", p.resource_pattern(), p.action()))
            .collect::<Vec<_>>()
            .join(", ")
    };
    println!(
        "Validated token for subject {} with permissions {}",
        claims.subject, perm_list
    );

    Ok(())
}

Trait Implementations

impl Clone for Permission

fn clone(&self) -> Permission

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Permission

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Permission

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Ord for Permission

fn cmp(&self, other: &Permission) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for Permission

fn eq(&self, other: &Permission) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for Permission

fn partial_cmp(&self, other: &Permission) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for Permission

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for Permission

impl StructuralPartialEq for Permission