authkestra_devsig/
identity.rs

1//! The success output of `verify()`.
2
3use serde_json::Value;
4
5/// Identity established by a request that passed every step of the verification algorithm.
6///
7/// `subject` and `device` come from the attestation; `key_thumbprint` is recomputed by the
8/// verifier from the request signature's embedded `jwk` (it necessarily equals the
9/// attestation's `cnf.jkt` — that equality *is* the binding check — but it is threaded through
10/// separately here to document that this value was derived from the live request, not merely
11/// copied out of the attestation).
12#[derive(Debug, Clone, PartialEq, Eq)]
13pub struct DeviceIdentity {
14    /// The attestation's `sub` claim — the authenticated identity.
15    pub subject: String,
16    /// The attestation's `did` claim — the device identifier.
17    pub device: String,
18    /// The RFC 7638 SHA-256 thumbprint of the request-signature's embedded `jwk`.
19    pub key_thumbprint: String,
20    /// The attestation's `att` claim — application attributes. Opaque to this crate; surfaced
21    /// as-is to the application.
22    pub attributes: Value,
23}
authkestra_devsig/identity.rs

authkestra_devsig/
identity.rs
