Struct VerificationOptions

pub struct VerificationOptions {

    pub verify_exp: bool,
    pub require_exp: bool,
    pub verify_nbf: bool,
    pub expected_issuer: Option<String>,
    pub require_iss: bool,
    pub expected_audience: Option<String>,
    pub require_aud: bool,
    pub verify_catu: bool,
    pub uri: Option<String>,
    pub verify_catm: bool,
    pub http_method: Option<String>,
    pub verify_catreplay: bool,
    pub token_seen_before: bool,
}

Options for token verification

Fields

verify_exp: bool

Verify expiration claim

require_exp: bool

Require expiration claim

verify_nbf: bool

Verify not before claim

expected_issuer: Option<String>

Expected issuer

require_iss: bool

Require issuer claim

expected_audience: Option<String>

Expected audience

require_aud: bool

Require audience claim

verify_catu: bool

Verify CAT-specific URI claim (CATU) against provided URI

uri: Option<String>

URI to verify against CATU claim

verify_catm: bool

Verify CAT-specific HTTP methods claim (CATM) against provided method

http_method: Option<String>

HTTP method to verify against CATM claim

verify_catreplay: bool

Verify CAT-specific replay protection (CATREPLAY)

token_seen_before: bool

Whether the token has been seen before (for replay protection)

Implementations

impl VerificationOptions

pub fn new() -> Self

Create new default verification options

Examples found in repository

examples/cat_specific_claims.rs (line 28)

fn main() {
    // Create a key for signing and verification
    let key = b"my-secret-key-for-hmac-sha256";

    // Create a token with CAT-specific claims
    let token = create_token_with_cat_claims(key);

    // Encode token to bytes
    let token_bytes = token.to_bytes().expect("Failed to encode token");
    println!("Token encoded to {} bytes", token_bytes.len());

    // Decode and verify the token
    let decoded_token =
        common_access_token::Token::from_bytes(&token_bytes).expect("Failed to decode token");

    // Verify the signature
    decoded_token
        .verify(key)
        .expect("Failed to verify signature");

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .expected_issuer("example-issuer");

    decoded_token
        .verify_claims(&options)
        .expect("Failed to verify claims");

    // Print token information
    print_token_info(&decoded_token);
}

examples/basic_usage.rs (line 144)

fn verify_token(token_bytes: &[u8], key: &[u8], expected_token_type: &str) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode {} token: {}", expected_token_type, err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!(
            "Failed to verify {} token signature: {}",
            expected_token_type, err
        );
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!(
            "Failed to verify {} token claims: {}",
            expected_token_type, err
        );
        return;
    }

    // Get the key ID
    let kid = token.header.key_id().expect("No key ID in token");
    let kid_str = match &kid {
        KeyId::Binary(data) => format!("Binary key ID: {:?}", data),
        KeyId::String(data) => format!("String key ID: {}", data),
    };

    println!(
        "Successfully verified {} token ({})",
        expected_token_type, kid_str
    );

    // Print some claims
    if let Some(iss) = &token.claims.registered.iss {
        println!("  Issuer: {}", iss);
    }
    if let Some(sub) = &token.claims.registered.sub {
        println!("  Subject: {}", sub);
    }
    if let Some(exp) = token.claims.registered.exp {
        println!(
            "  Expires at: {} (in {} seconds)",
            exp,
            exp - current_timestamp()
        );
    }
}

/// Verify a token with a nested map claim
fn verify_nested_map_token(token_bytes: &[u8], key: &[u8]) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode nested map token: {}", err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!("Failed to verify nested map token signature: {}", err);
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!("Failed to verify nested map token claims: {}", err);
        return;
    }

    println!("Successfully verified nested map token");

    // Check for the nested map claim
    if let Some(CborValue::Map(map)) = token.claims.custom.get(&200) {
        println!("  Found nested map claim with {} entries", map.len());

        // Print first level entries
        if let Some(CborValue::Text(text)) = map.get(&1) {
            println!("  Entry 1: Text = {}", text);
        }

        if let Some(CborValue::Integer(num)) = map.get(&2) {
            println!("  Entry 2: Integer = {}", num);
        }

        if let Some(CborValue::Bytes(bytes)) = map.get(&3) {
            println!("  Entry 3: Bytes = {:?}", bytes);
        }

        // Check for second level map
        if let Some(CborValue::Map(second_map)) = map.get(&4) {
            println!("  Entry 4: Nested map with {} entries", second_map.len());

            if let Some(CborValue::Text(text)) = second_map.get(&1) {
                println!("    Nested Entry 1: Text = {}", text);
            }

            if let Some(CborValue::Integer(num)) = second_map.get(&2) {
                println!("    Nested Entry 2: Integer = {}", num);
            }
        }
    } else {
        println!("  Nested map claim not found!");
    }
}

examples/cat_validation.rs (line 104)

fn validate_catu_claim(token: &common_access_token::Token) {
    println!("\nValidating CATU (URI) claim:");

    // Define URIs to test
    let valid_uri = "https://api.example.com/api/users.json";
    let invalid_scheme_uri = "http://api.example.com/api/users.json";
    let invalid_host_uri = "https://api.other-site.com/api/users.json";
    let invalid_path_uri = "https://api.example.com/users.json";
    let invalid_extension_uri = "https://api.example.com/api/users.xml";

    // Test valid URI
    let options = VerificationOptions::new().verify_catu(true).uri(valid_uri);

    match token.verify_claims(&options) {
        Ok(_) => println!("  VALID URI: {}", valid_uri),
        Err(e) => println!(
            "  ERROR: {} should be valid, but got error: {}",
            valid_uri, e
        ),
    }

    // Test invalid scheme
    let invalid_scheme_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_scheme_uri);

    match token.verify_claims(&invalid_scheme_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong scheme)",
            invalid_scheme_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_scheme_uri, e
        ),
    }

    // Test invalid host
    let invalid_host_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_host_uri);

    match token.verify_claims(&invalid_host_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong host)",
            invalid_host_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_host_uri, e
        ),
    }

    // Test invalid path
    let invalid_path_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_path_uri);

    match token.verify_claims(&invalid_path_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong path)",
            invalid_path_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_path_uri, e
        ),
    }

    // Test invalid extension
    let invalid_extension_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_extension_uri);

    match token.verify_claims(&invalid_extension_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong extension)",
            invalid_extension_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_extension_uri, e
        ),
    }
}

/// Validate the CATM claim against different HTTP methods
fn validate_catm_claim(token: &common_access_token::Token) {
    println!("\nValidating CATM (HTTP Methods) claim:");

    // Test allowed methods
    for method in &["GET", "HEAD", "OPTIONS"] {
        let options = VerificationOptions::new()
            .verify_catm(true)
            .http_method(*method);

        match token.verify_claims(&options) {
            Ok(_) => println!("  VALID METHOD: {}", method),
            Err(e) => println!("  ERROR: {} should be valid, but got error: {}", method, e),
        }
    }

    // Test disallowed methods
    for method in &["POST", "PUT", "DELETE", "PATCH"] {
        let options = VerificationOptions::new()
            .verify_catm(true)
            .http_method(*method);

        match token.verify_claims(&options) {
            Ok(_) => println!("  ERROR: {} should be invalid method", method),
            Err(e) => println!("  INVALID METHOD (as expected): {} - Error: {}", method, e),
        }
    }
}

/// Validate the CATREPLAY claim
fn validate_catreplay_claim(token: &common_access_token::Token) {
    println!("\nValidating CATREPLAY claim:");

    // Test with token not seen before (should pass)
    let options_not_seen = VerificationOptions::new()
        .verify_catreplay(true)
        .token_seen_before(false);

    match token.verify_claims(&options_not_seen) {
        Ok(_) => println!("  VALID: Token not seen before is accepted (as expected)"),
        Err(e) => println!(
            "  ERROR: Token not seen before should be valid, but got error: {}",
            e
        ),
    }

    // Test with token seen before (should fail with replay prohibited)
    let options_seen = VerificationOptions::new()
        .verify_catreplay(true)
        .token_seen_before(true);

    match token.verify_claims(&options_seen) {
        Ok(_) => println!("  ERROR: Token seen before should be rejected"),
        Err(e) => println!(
            "  INVALID (as expected): Token seen before is rejected - Error: {}",
            e
        ),
    }
}

pub fn verify_exp(self, verify: bool) -> Self

Set whether to verify expiration

Examples found in repository

examples/cat_specific_claims.rs (line 29)

fn main() {
    // Create a key for signing and verification
    let key = b"my-secret-key-for-hmac-sha256";

    // Create a token with CAT-specific claims
    let token = create_token_with_cat_claims(key);

    // Encode token to bytes
    let token_bytes = token.to_bytes().expect("Failed to encode token");
    println!("Token encoded to {} bytes", token_bytes.len());

    // Decode and verify the token
    let decoded_token =
        common_access_token::Token::from_bytes(&token_bytes).expect("Failed to decode token");

    // Verify the signature
    decoded_token
        .verify(key)
        .expect("Failed to verify signature");

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .expected_issuer("example-issuer");

    decoded_token
        .verify_claims(&options)
        .expect("Failed to verify claims");

    // Print token information
    print_token_info(&decoded_token);
}

examples/basic_usage.rs (line 145)

fn verify_token(token_bytes: &[u8], key: &[u8], expected_token_type: &str) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode {} token: {}", expected_token_type, err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!(
            "Failed to verify {} token signature: {}",
            expected_token_type, err
        );
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!(
            "Failed to verify {} token claims: {}",
            expected_token_type, err
        );
        return;
    }

    // Get the key ID
    let kid = token.header.key_id().expect("No key ID in token");
    let kid_str = match &kid {
        KeyId::Binary(data) => format!("Binary key ID: {:?}", data),
        KeyId::String(data) => format!("String key ID: {}", data),
    };

    println!(
        "Successfully verified {} token ({})",
        expected_token_type, kid_str
    );

    // Print some claims
    if let Some(iss) = &token.claims.registered.iss {
        println!("  Issuer: {}", iss);
    }
    if let Some(sub) = &token.claims.registered.sub {
        println!("  Subject: {}", sub);
    }
    if let Some(exp) = token.claims.registered.exp {
        println!(
            "  Expires at: {} (in {} seconds)",
            exp,
            exp - current_timestamp()
        );
    }
}

/// Verify a token with a nested map claim
fn verify_nested_map_token(token_bytes: &[u8], key: &[u8]) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode nested map token: {}", err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!("Failed to verify nested map token signature: {}", err);
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!("Failed to verify nested map token claims: {}", err);
        return;
    }

    println!("Successfully verified nested map token");

    // Check for the nested map claim
    if let Some(CborValue::Map(map)) = token.claims.custom.get(&200) {
        println!("  Found nested map claim with {} entries", map.len());

        // Print first level entries
        if let Some(CborValue::Text(text)) = map.get(&1) {
            println!("  Entry 1: Text = {}", text);
        }

        if let Some(CborValue::Integer(num)) = map.get(&2) {
            println!("  Entry 2: Integer = {}", num);
        }

        if let Some(CborValue::Bytes(bytes)) = map.get(&3) {
            println!("  Entry 3: Bytes = {:?}", bytes);
        }

        // Check for second level map
        if let Some(CborValue::Map(second_map)) = map.get(&4) {
            println!("  Entry 4: Nested map with {} entries", second_map.len());

            if let Some(CborValue::Text(text)) = second_map.get(&1) {
                println!("    Nested Entry 1: Text = {}", text);
            }

            if let Some(CborValue::Integer(num)) = second_map.get(&2) {
                println!("    Nested Entry 2: Integer = {}", num);
            }
        }
    } else {
        println!("  Nested map claim not found!");
    }
}

pub fn require_exp(self, require: bool) -> Self

Set whether to require expiration

pub fn verify_nbf(self, verify: bool) -> Self

Set whether to verify not before

Examples found in repository

examples/basic_usage.rs (line 146)

fn verify_token(token_bytes: &[u8], key: &[u8], expected_token_type: &str) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode {} token: {}", expected_token_type, err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!(
            "Failed to verify {} token signature: {}",
            expected_token_type, err
        );
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!(
            "Failed to verify {} token claims: {}",
            expected_token_type, err
        );
        return;
    }

    // Get the key ID
    let kid = token.header.key_id().expect("No key ID in token");
    let kid_str = match &kid {
        KeyId::Binary(data) => format!("Binary key ID: {:?}", data),
        KeyId::String(data) => format!("String key ID: {}", data),
    };

    println!(
        "Successfully verified {} token ({})",
        expected_token_type, kid_str
    );

    // Print some claims
    if let Some(iss) = &token.claims.registered.iss {
        println!("  Issuer: {}", iss);
    }
    if let Some(sub) = &token.claims.registered.sub {
        println!("  Subject: {}", sub);
    }
    if let Some(exp) = token.claims.registered.exp {
        println!(
            "  Expires at: {} (in {} seconds)",
            exp,
            exp - current_timestamp()
        );
    }
}

/// Verify a token with a nested map claim
fn verify_nested_map_token(token_bytes: &[u8], key: &[u8]) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode nested map token: {}", err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!("Failed to verify nested map token signature: {}", err);
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!("Failed to verify nested map token claims: {}", err);
        return;
    }

    println!("Successfully verified nested map token");

    // Check for the nested map claim
    if let Some(CborValue::Map(map)) = token.claims.custom.get(&200) {
        println!("  Found nested map claim with {} entries", map.len());

        // Print first level entries
        if let Some(CborValue::Text(text)) = map.get(&1) {
            println!("  Entry 1: Text = {}", text);
        }

        if let Some(CborValue::Integer(num)) = map.get(&2) {
            println!("  Entry 2: Integer = {}", num);
        }

        if let Some(CborValue::Bytes(bytes)) = map.get(&3) {
            println!("  Entry 3: Bytes = {:?}", bytes);
        }

        // Check for second level map
        if let Some(CborValue::Map(second_map)) = map.get(&4) {
            println!("  Entry 4: Nested map with {} entries", second_map.len());

            if let Some(CborValue::Text(text)) = second_map.get(&1) {
                println!("    Nested Entry 1: Text = {}", text);
            }

            if let Some(CborValue::Integer(num)) = second_map.get(&2) {
                println!("    Nested Entry 2: Integer = {}", num);
            }
        }
    } else {
        println!("  Nested map claim not found!");
    }
}

pub fn expected_issuer<S: Into<String>>(self, issuer: S) -> Self

Set expected issuer

Examples found in repository

examples/cat_specific_claims.rs (line 30)

fn main() {
    // Create a key for signing and verification
    let key = b"my-secret-key-for-hmac-sha256";

    // Create a token with CAT-specific claims
    let token = create_token_with_cat_claims(key);

    // Encode token to bytes
    let token_bytes = token.to_bytes().expect("Failed to encode token");
    println!("Token encoded to {} bytes", token_bytes.len());

    // Decode and verify the token
    let decoded_token =
        common_access_token::Token::from_bytes(&token_bytes).expect("Failed to decode token");

    // Verify the signature
    decoded_token
        .verify(key)
        .expect("Failed to verify signature");

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .expected_issuer("example-issuer");

    decoded_token
        .verify_claims(&options)
        .expect("Failed to verify claims");

    // Print token information
    print_token_info(&decoded_token);
}

examples/basic_usage.rs (line 147)

fn verify_token(token_bytes: &[u8], key: &[u8], expected_token_type: &str) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode {} token: {}", expected_token_type, err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!(
            "Failed to verify {} token signature: {}",
            expected_token_type, err
        );
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!(
            "Failed to verify {} token claims: {}",
            expected_token_type, err
        );
        return;
    }

    // Get the key ID
    let kid = token.header.key_id().expect("No key ID in token");
    let kid_str = match &kid {
        KeyId::Binary(data) => format!("Binary key ID: {:?}", data),
        KeyId::String(data) => format!("String key ID: {}", data),
    };

    println!(
        "Successfully verified {} token ({})",
        expected_token_type, kid_str
    );

    // Print some claims
    if let Some(iss) = &token.claims.registered.iss {
        println!("  Issuer: {}", iss);
    }
    if let Some(sub) = &token.claims.registered.sub {
        println!("  Subject: {}", sub);
    }
    if let Some(exp) = token.claims.registered.exp {
        println!(
            "  Expires at: {} (in {} seconds)",
            exp,
            exp - current_timestamp()
        );
    }
}

/// Verify a token with a nested map claim
fn verify_nested_map_token(token_bytes: &[u8], key: &[u8]) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode nested map token: {}", err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!("Failed to verify nested map token signature: {}", err);
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!("Failed to verify nested map token claims: {}", err);
        return;
    }

    println!("Successfully verified nested map token");

    // Check for the nested map claim
    if let Some(CborValue::Map(map)) = token.claims.custom.get(&200) {
        println!("  Found nested map claim with {} entries", map.len());

        // Print first level entries
        if let Some(CborValue::Text(text)) = map.get(&1) {
            println!("  Entry 1: Text = {}", text);
        }

        if let Some(CborValue::Integer(num)) = map.get(&2) {
            println!("  Entry 2: Integer = {}", num);
        }

        if let Some(CborValue::Bytes(bytes)) = map.get(&3) {
            println!("  Entry 3: Bytes = {:?}", bytes);
        }

        // Check for second level map
        if let Some(CborValue::Map(second_map)) = map.get(&4) {
            println!("  Entry 4: Nested map with {} entries", second_map.len());

            if let Some(CborValue::Text(text)) = second_map.get(&1) {
                println!("    Nested Entry 1: Text = {}", text);
            }

            if let Some(CborValue::Integer(num)) = second_map.get(&2) {
                println!("    Nested Entry 2: Integer = {}", num);
            }
        }
    } else {
        println!("  Nested map claim not found!");
    }
}

pub fn require_iss(self, require: bool) -> Self

Set whether to require issuer

pub fn expected_audience<S: Into<String>>(self, audience: S) -> Self

Set expected audience

Examples found in repository

examples/basic_usage.rs (line 148)

fn verify_token(token_bytes: &[u8], key: &[u8], expected_token_type: &str) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode {} token: {}", expected_token_type, err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!(
            "Failed to verify {} token signature: {}",
            expected_token_type, err
        );
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!(
            "Failed to verify {} token claims: {}",
            expected_token_type, err
        );
        return;
    }

    // Get the key ID
    let kid = token.header.key_id().expect("No key ID in token");
    let kid_str = match &kid {
        KeyId::Binary(data) => format!("Binary key ID: {:?}", data),
        KeyId::String(data) => format!("String key ID: {}", data),
    };

    println!(
        "Successfully verified {} token ({})",
        expected_token_type, kid_str
    );

    // Print some claims
    if let Some(iss) = &token.claims.registered.iss {
        println!("  Issuer: {}", iss);
    }
    if let Some(sub) = &token.claims.registered.sub {
        println!("  Subject: {}", sub);
    }
    if let Some(exp) = token.claims.registered.exp {
        println!(
            "  Expires at: {} (in {} seconds)",
            exp,
            exp - current_timestamp()
        );
    }
}

/// Verify a token with a nested map claim
fn verify_nested_map_token(token_bytes: &[u8], key: &[u8]) {
    // Decode the token
    let token = match common_access_token::Token::from_bytes(token_bytes) {
        Ok(token) => token,
        Err(err) => {
            println!("Failed to decode nested map token: {}", err);
            return;
        }
    };

    // Verify the signature
    if let Err(err) = token.verify(key) {
        println!("Failed to verify nested map token signature: {}", err);
        return;
    }

    // Verify the claims
    let options = VerificationOptions::new()
        .verify_exp(true)
        .verify_nbf(true)
        .expected_issuer("example-issuer")
        .expected_audience("example-audience");

    if let Err(err) = token.verify_claims(&options) {
        println!("Failed to verify nested map token claims: {}", err);
        return;
    }

    println!("Successfully verified nested map token");

    // Check for the nested map claim
    if let Some(CborValue::Map(map)) = token.claims.custom.get(&200) {
        println!("  Found nested map claim with {} entries", map.len());

        // Print first level entries
        if let Some(CborValue::Text(text)) = map.get(&1) {
            println!("  Entry 1: Text = {}", text);
        }

        if let Some(CborValue::Integer(num)) = map.get(&2) {
            println!("  Entry 2: Integer = {}", num);
        }

        if let Some(CborValue::Bytes(bytes)) = map.get(&3) {
            println!("  Entry 3: Bytes = {:?}", bytes);
        }

        // Check for second level map
        if let Some(CborValue::Map(second_map)) = map.get(&4) {
            println!("  Entry 4: Nested map with {} entries", second_map.len());

            if let Some(CborValue::Text(text)) = second_map.get(&1) {
                println!("    Nested Entry 1: Text = {}", text);
            }

            if let Some(CborValue::Integer(num)) = second_map.get(&2) {
                println!("    Nested Entry 2: Integer = {}", num);
            }
        }
    } else {
        println!("  Nested map claim not found!");
    }
}

pub fn require_aud(self, require: bool) -> Self

Set whether to require audience

pub fn verify_catu(self, verify: bool) -> Self

Set whether to verify CAT-specific URI claim (CATU)

Examples found in repository

examples/cat_validation.rs (line 104)

fn validate_catu_claim(token: &common_access_token::Token) {
    println!("\nValidating CATU (URI) claim:");

    // Define URIs to test
    let valid_uri = "https://api.example.com/api/users.json";
    let invalid_scheme_uri = "http://api.example.com/api/users.json";
    let invalid_host_uri = "https://api.other-site.com/api/users.json";
    let invalid_path_uri = "https://api.example.com/users.json";
    let invalid_extension_uri = "https://api.example.com/api/users.xml";

    // Test valid URI
    let options = VerificationOptions::new().verify_catu(true).uri(valid_uri);

    match token.verify_claims(&options) {
        Ok(_) => println!("  VALID URI: {}", valid_uri),
        Err(e) => println!(
            "  ERROR: {} should be valid, but got error: {}",
            valid_uri, e
        ),
    }

    // Test invalid scheme
    let invalid_scheme_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_scheme_uri);

    match token.verify_claims(&invalid_scheme_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong scheme)",
            invalid_scheme_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_scheme_uri, e
        ),
    }

    // Test invalid host
    let invalid_host_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_host_uri);

    match token.verify_claims(&invalid_host_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong host)",
            invalid_host_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_host_uri, e
        ),
    }

    // Test invalid path
    let invalid_path_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_path_uri);

    match token.verify_claims(&invalid_path_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong path)",
            invalid_path_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_path_uri, e
        ),
    }

    // Test invalid extension
    let invalid_extension_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_extension_uri);

    match token.verify_claims(&invalid_extension_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong extension)",
            invalid_extension_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_extension_uri, e
        ),
    }
}

pub fn uri<S: Into<String>>(self, uri: S) -> Self

Set URI to verify against CATU claim

Examples found in repository

examples/cat_validation.rs (line 104)

fn validate_catu_claim(token: &common_access_token::Token) {
    println!("\nValidating CATU (URI) claim:");

    // Define URIs to test
    let valid_uri = "https://api.example.com/api/users.json";
    let invalid_scheme_uri = "http://api.example.com/api/users.json";
    let invalid_host_uri = "https://api.other-site.com/api/users.json";
    let invalid_path_uri = "https://api.example.com/users.json";
    let invalid_extension_uri = "https://api.example.com/api/users.xml";

    // Test valid URI
    let options = VerificationOptions::new().verify_catu(true).uri(valid_uri);

    match token.verify_claims(&options) {
        Ok(_) => println!("  VALID URI: {}", valid_uri),
        Err(e) => println!(
            "  ERROR: {} should be valid, but got error: {}",
            valid_uri, e
        ),
    }

    // Test invalid scheme
    let invalid_scheme_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_scheme_uri);

    match token.verify_claims(&invalid_scheme_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong scheme)",
            invalid_scheme_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_scheme_uri, e
        ),
    }

    // Test invalid host
    let invalid_host_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_host_uri);

    match token.verify_claims(&invalid_host_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong host)",
            invalid_host_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_host_uri, e
        ),
    }

    // Test invalid path
    let invalid_path_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_path_uri);

    match token.verify_claims(&invalid_path_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong path)",
            invalid_path_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_path_uri, e
        ),
    }

    // Test invalid extension
    let invalid_extension_options = VerificationOptions::new()
        .verify_catu(true)
        .uri(invalid_extension_uri);

    match token.verify_claims(&invalid_extension_options) {
        Ok(_) => println!(
            "  ERROR: {} should be invalid (wrong extension)",
            invalid_extension_uri
        ),
        Err(e) => println!(
            "  INVALID URI (as expected): {} - Error: {}",
            invalid_extension_uri, e
        ),
    }
}

pub fn verify_catm(self, verify: bool) -> Self

Set whether to verify CAT-specific HTTP methods claim (CATM)

Examples found in repository

examples/cat_validation.rs (line 186)

fn validate_catm_claim(token: &common_access_token::Token) {
    println!("\nValidating CATM (HTTP Methods) claim:");

    // Test allowed methods
    for method in &["GET", "HEAD", "OPTIONS"] {
        let options = VerificationOptions::new()
            .verify_catm(true)
            .http_method(*method);

        match token.verify_claims(&options) {
            Ok(_) => println!("  VALID METHOD: {}", method),
            Err(e) => println!("  ERROR: {} should be valid, but got error: {}", method, e),
        }
    }

    // Test disallowed methods
    for method in &["POST", "PUT", "DELETE", "PATCH"] {
        let options = VerificationOptions::new()
            .verify_catm(true)
            .http_method(*method);

        match token.verify_claims(&options) {
            Ok(_) => println!("  ERROR: {} should be invalid method", method),
            Err(e) => println!("  INVALID METHOD (as expected): {} - Error: {}", method, e),
        }
    }
}

pub fn http_method<S: Into<String>>(self, method: S) -> Self

Set HTTP method to verify against CATM claim

Examples found in repository

examples/cat_validation.rs (line 187)

fn validate_catm_claim(token: &common_access_token::Token) {
    println!("\nValidating CATM (HTTP Methods) claim:");

    // Test allowed methods
    for method in &["GET", "HEAD", "OPTIONS"] {
        let options = VerificationOptions::new()
            .verify_catm(true)
            .http_method(*method);

        match token.verify_claims(&options) {
            Ok(_) => println!("  VALID METHOD: {}", method),
            Err(e) => println!("  ERROR: {} should be valid, but got error: {}", method, e),
        }
    }

    // Test disallowed methods
    for method in &["POST", "PUT", "DELETE", "PATCH"] {
        let options = VerificationOptions::new()
            .verify_catm(true)
            .http_method(*method);

        match token.verify_claims(&options) {
            Ok(_) => println!("  ERROR: {} should be invalid method", method),
            Err(e) => println!("  INVALID METHOD (as expected): {} - Error: {}", method, e),
        }
    }
}

pub fn verify_catreplay(self, verify: bool) -> Self

Set whether to verify CAT-specific replay protection (CATREPLAY)

Examples found in repository

examples/cat_validation.rs (line 214)

fn validate_catreplay_claim(token: &common_access_token::Token) {
    println!("\nValidating CATREPLAY claim:");

    // Test with token not seen before (should pass)
    let options_not_seen = VerificationOptions::new()
        .verify_catreplay(true)
        .token_seen_before(false);

    match token.verify_claims(&options_not_seen) {
        Ok(_) => println!("  VALID: Token not seen before is accepted (as expected)"),
        Err(e) => println!(
            "  ERROR: Token not seen before should be valid, but got error: {}",
            e
        ),
    }

    // Test with token seen before (should fail with replay prohibited)
    let options_seen = VerificationOptions::new()
        .verify_catreplay(true)
        .token_seen_before(true);

    match token.verify_claims(&options_seen) {
        Ok(_) => println!("  ERROR: Token seen before should be rejected"),
        Err(e) => println!(
            "  INVALID (as expected): Token seen before is rejected - Error: {}",
            e
        ),
    }
}

pub fn token_seen_before(self, seen: bool) -> Self

Set whether the token has been seen before (for replay protection)

Examples found in repository

examples/cat_validation.rs (line 215)

fn validate_catreplay_claim(token: &common_access_token::Token) {
    println!("\nValidating CATREPLAY claim:");

    // Test with token not seen before (should pass)
    let options_not_seen = VerificationOptions::new()
        .verify_catreplay(true)
        .token_seen_before(false);

    match token.verify_claims(&options_not_seen) {
        Ok(_) => println!("  VALID: Token not seen before is accepted (as expected)"),
        Err(e) => println!(
            "  ERROR: Token not seen before should be valid, but got error: {}",
            e
        ),
    }

    // Test with token seen before (should fail with replay prohibited)
    let options_seen = VerificationOptions::new()
        .verify_catreplay(true)
        .token_seen_before(true);

    match token.verify_claims(&options_seen) {
        Ok(_) => println!("  ERROR: Token seen before should be rejected"),
        Err(e) => println!(
            "  INVALID (as expected): Token seen before is rejected - Error: {}",
            e
        ),
    }
}

Trait Implementations

impl Clone for VerificationOptions

fn clone(&self) -> VerificationOptions

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerificationOptions

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for VerificationOptions

fn default() -> VerificationOptions

Returns the “default value” for a type.