authnz-common 0.2.1

//! MPAAT module.

use serde::{Deserialize, Serialize};

#[cfg(any(feature = "pqc-utils", feature = "ed25519-utils"))]
use crate::{MResult, ServerError};

#[derive(Deserialize, Serialize, PartialEq, Eq, Hash, Clone)]
/// MPAAT header: unencrypted metadata to acquire the payload.
pub struct MPAATHeader<U> {
  /// C3A public key.
  pub authnz_pkey: Vec<u8>,
  /// Encryption nonce.
  pub nonce: Vec<u8>,
  #[serde(flatten)]
  /// Common public fields (default MPAAT CPF for C3A worker is `DefaultCommonFields` with encryption key ID).
  pub common_public_fields: Option<U>,
}

#[derive(Deserialize, Serialize, PartialEq, Eq, Hash, Clone)]
/// MPAAT payload: encrypted user metadata.
pub struct MPAATPayload<T> {
  /// Client-side public key. May be empty if CBA is disabled.
  pub cli_pkey: Vec<u8>,
  /// Token expiration timestamp.
  pub exp: chrono::DateTime<chrono::Utc>,
  #[serde(flatten)]
  /// Payload container (default MPAAT container for C3A worker is `DefaultWorkerPayload` with user ID hash, CBA requirement flag and authorized tags).
  pub container: T,
}

#[derive(Deserialize, Serialize, PartialEq, Eq, Hash, Clone)]
/// MPAAT signature: unencrypted signature of header and payload.
pub struct MPAATSignature {
  /// Ed25519 signature.
  pub sig: Vec<u8>,
}

#[cfg(any(feature = "pqc-utils", feature = "ed25519-utils"))]
impl<U: serde::Serialize> MPAATHeader<U> {
  /// Signs MPAAT header and payload.
  ///
  /// Note that payload must be encrypted already.
  pub fn sign_mpaat(&self, payload: &[u8], keypair: &crate::SignKeypair) -> MResult<Vec<u8>> {
    let mut data = rmp_serde::to_vec(self).map_err(ServerError::from_private)?;
    data.extend_from_slice(payload);
    Ok(keypair.sign_raw(&data))
  }
}