foundation_auth 0.0.4

Authentication and authorization — OAuth2/OIDC flows, JWT handling, password hashing (Argon2), TOTP, and session management with Turso/SQLite and wasm-bindgen backends
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

//! OAuth token data type (pure data, no native deps).

use serde::{Deserialize, Serialize};

use crate::shared::jwt::JwtToken;

/// OAuth token response.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct OAuthToken {
    /// Access token.
    pub access_token: String,
    /// Token type (usually "Bearer").
    pub token_type: String,
    /// Expires in seconds.
    pub expires_in: Option<u64>,
    /// Refresh token (if provided).
    pub refresh_token: Option<String>,
    /// Granted scopes.
    pub scope: Option<String>,
    /// ID token (for OIDC).
    pub id_token: Option<String>,
}

impl OAuthToken {
    /// Convert to a [`JwtToken`].
    #[must_use]
    #[allow(clippy::cast_possible_wrap)]
    pub fn into_jwt_token(self) -> Option<JwtToken> {
        let expires_at = self.expires_in.map_or_else(
            || chrono::Utc::now().timestamp() + 3600,
            |exp| chrono::Utc::now().timestamp() + exp as i64,
        );

        JwtToken::from_parts(
            self.access_token,
            self.refresh_token,
            expires_at,
            self.scope,
            None,
            None,
        )
        .into()
    }

    /// Check if the token is expired.
    #[must_use]
    pub fn is_expired(&self, buffer_seconds: u64) -> bool {
        self.expires_in.is_some_and(|exp| exp <= buffer_seconds)
    }
}