authnz-common 0.2.1

//! Light MPAAT module.

use serde::{Deserialize, Serialize};

#[cfg(any(feature = "pqc-utils", feature = "ed25519-utils"))]
use crate::{MResult, ServerError};

#[derive(Deserialize, Serialize, PartialEq, Eq, Hash, Clone)]
/// LMPAAT header: unencrypted metadata.
pub struct LightMPAATHeader<U> {
  /// Client-side public key. May be empty if CBA is disabled.
  pub cli_pkey: Vec<u8>,
  #[serde(flatten)]
  /// Common public fields.
  pub common_public_fields: Option<U>,
}

#[derive(Deserialize, Serialize, PartialEq, Eq, Hash, Clone)]
/// LMPAAT payload: unencrypted metadata.
pub struct LightMPAATPayload<T> {
  /// Token expiration timestamp.
  pub exp: chrono::DateTime<chrono::Utc>,
  #[serde(flatten)]
  /// Payload container.
  pub container: T,
}

#[derive(Deserialize, Serialize, PartialEq, Eq, Hash, Clone)]
/// LMPAAT signature: unencrypted signature of header and payload.
pub struct LightMPAATSignature {
  /// Ed25519 signature.
  pub sig: Vec<u8>,
}

#[cfg(any(feature = "pqc-utils", feature = "ed25519-utils"))]
impl<U: serde::Serialize> LightMPAATHeader<U> {
  /// Signs LMPAAT header and payload.
  pub fn sign_lmpaat<T: serde::Serialize>(&self, payload: &LightMPAATPayload<T>, keypair: &crate::SignKeypair) -> MResult<Vec<u8>> {
    let mut data = rmp_serde::to_vec(self).map_err(ServerError::from_private)?;
    data.extend_from_slice(&rmp_serde::to_vec(payload).map_err(ServerError::from_private)?);
    Ok(keypair.sign_raw(&data))
  }
}