aauth 0.0.2

Rust implementation of the AAuth authorization protocol
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

use crate::jwt::AgentClaims;

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum AudienceError {
    NoAudience,
}

impl std::fmt::Display for AudienceError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::NoAudience => f.write_str(
                "cannot determine resource token audience: no access server, no agent ps claim, and no fallback",
            ),
        }
    }
}

impl std::error::Error for AudienceError {}

/// Resolve resource token `aud` per spec `#requirement-auth-token`.
pub fn resolve_resource_token_audience(
    agent: &AgentClaims,
    access_server_url: Option<&str>,
    person_server_fallback: Option<&str>,
) -> Result<String, AudienceError> {
    if let Some(as_url) = access_server_url {
        return Ok(as_url.to_string());
    }
    if let Some(ps) = &agent.ps {
        return Ok(ps.clone());
    }
    if let Some(fallback) = person_server_fallback {
        return Ok(fallback.to_string());
    }
    Err(AudienceError::NoAudience)
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::jwt::{AgentClaims, CnfClaim, OkpJwk};

    fn agent(ps: Option<&str>) -> AgentClaims {
        AgentClaims {
            iss: "https://agent.example".into(),
            dwk: "aauth-agent.json".into(),
            sub: "aauth:test@example.com".into(),
            jti: "jti".into(),
            cnf: CnfClaim {
                jwk: OkpJwk {
                    kty: "OKP".into(),
                    crv: "Ed25519".into(),
                    x: "x".into(),
                    kid: None,
                },
            },
            iat: 0,
            exp: 9999999999,
            ps: ps.map(str::to_string),
        }
    }

    #[test]
    fn access_server_takes_priority() {
        assert_eq!(
            resolve_resource_token_audience(
                &agent(Some("https://ps.example")),
                Some("https://as.example"),
                None,
            )
            .unwrap(),
            "https://as.example"
        );
    }

    #[test]
    fn ps_claim_used_when_no_as() {
        assert_eq!(
            resolve_resource_token_audience(&agent(Some("https://ps.example")), None, None,)
                .unwrap(),
            "https://ps.example"
        );
    }

    #[test]
    fn fallback_for_tests() {
        assert_eq!(
            resolve_resource_token_audience(&agent(None), None, Some("https://ps.example"))
                .unwrap(),
            "https://ps.example"
        );
    }

    #[test]
    fn none_when_unresolvable() {
        assert!(resolve_resource_token_audience(&agent(None), None, None).is_err());
    }
}