qnsp 0.2.0

Official Rust SDK for the QNSP Quantum-Native Security Platform — post-quantum cryptography (ML-KEM, ML-DSA, SLH-DSA, Falcon via liboqs), PQC-encrypted vault, KMS, and immutable audit trails.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

//! QNSP Auth — JWT issuance, refresh, revocation, WebAuthn passkeys, MFA,
//! federated identity (SAML / OIDC), risk-based authentication.

use reqwest::Method;
use serde::{Deserialize, Serialize};
use serde_json::Value;
use std::sync::Arc;

use crate::activation::Activation;
use crate::errors::Error;
use crate::service_client::ServiceClient;

const PATH_PREFIX: &str = "/auth/v1";

#[derive(Clone)]
pub struct Client {
    sc: ServiceClient,
}

impl Client {
    pub fn new(activation: Arc<Activation>, http: reqwest::Client) -> Self {
        Self { sc: ServiceClient::new(activation, http, PATH_PREFIX) }
    }

    pub async fn login(&self, req: LoginRequest) -> Result<Value, Error> {
        self.sc.request(Method::POST, "/login", Some(&req), None, None).await
    }

    pub async fn refresh_token(&self, refresh_token: &str) -> Result<Value, Error> {
        #[derive(Serialize)]
        struct Body<'a> {
            #[serde(rename = "refreshToken")]
            refresh_token: &'a str,
        }
        self.sc
            .request(Method::POST, "/refresh", Some(&Body { refresh_token }), None, None)
            .await
    }

    pub async fn revoke(&self, refresh_token: &str) -> Result<(), Error> {
        #[derive(Serialize)]
        struct Body<'a> {
            #[serde(rename = "refreshToken")]
            refresh_token: &'a str,
        }
        self.sc
            .request(Method::POST, "/revoke", Some(&Body { refresh_token }), None, None)
            .await?;
        Ok(())
    }

    // ── WebAuthn passkeys ────────────────────────────────────────────

    pub async fn register_passkey_start(&self, user_id: &str, tenant_id: &str) -> Result<Value, Error> {
        #[derive(Serialize)]
        struct Body<'a> {
            #[serde(rename = "userId")]
            user_id: &'a str,
            #[serde(rename = "tenantId")]
            tenant_id: &'a str,
        }
        self.sc
            .request(Method::POST, "/passkeys/register/start", Some(&Body { user_id, tenant_id }), None, None)
            .await
    }

    pub async fn register_passkey_complete(&self, body: serde_json::Map<String, Value>) -> Result<Value, Error> {
        self.sc
            .request(Method::POST, "/passkeys/register/complete", Some(&Value::Object(body)), None, None)
            .await
    }

    pub async fn authenticate_passkey_start(&self, body: serde_json::Map<String, Value>) -> Result<Value, Error> {
        self.sc
            .request(Method::POST, "/passkeys/authenticate/start", Some(&Value::Object(body)), None, None)
            .await
    }

    pub async fn authenticate_passkey_complete(&self, body: serde_json::Map<String, Value>) -> Result<Value, Error> {
        self.sc
            .request(Method::POST, "/passkeys/authenticate/complete", Some(&Value::Object(body)), None, None)
            .await
    }

    pub async fn list_passkeys(&self, user_id: &str, tenant_id: &str) -> Result<Value, Error> {
        let q = [("userId", user_id.to_string()), ("tenantId", tenant_id.to_string())];
        self.sc.request::<()>(Method::GET, "/passkeys", None, Some(&q), None).await
    }

    pub async fn delete_passkey(&self, credential_id: &str) -> Result<(), Error> {
        self.sc
            .request::<()>(Method::DELETE, &format!("/passkeys/{}", credential_id), None, None, None)
            .await?;
        Ok(())
    }

    // ── MFA ──────────────────────────────────────────────────────────

    pub async fn mfa_challenge(&self, body: serde_json::Map<String, Value>) -> Result<Value, Error> {
        self.sc.request(Method::POST, "/mfa/challenge", Some(&Value::Object(body)), None, None).await
    }

    pub async fn mfa_verify(&self, body: serde_json::Map<String, Value>) -> Result<Value, Error> {
        self.sc.request(Method::POST, "/mfa/verify", Some(&Value::Object(body)), None, None).await
    }

    // ── Federated identity ──────────────────────────────────────────

    pub async fn federate_saml(&self, body: serde_json::Map<String, Value>) -> Result<Value, Error> {
        self.sc.request(Method::POST, "/federate/saml", Some(&Value::Object(body)), None, None).await
    }

    pub async fn federate_oidc(&self, body: serde_json::Map<String, Value>) -> Result<Value, Error> {
        self.sc.request(Method::POST, "/federate/oidc", Some(&Value::Object(body)), None, None).await
    }

    // ── Risk-based auth ──────────────────────────────────────────────

    pub async fn evaluate_risk(&self, body: serde_json::Map<String, Value>) -> Result<Value, Error> {
        self.sc.request(Method::POST, "/risk/evaluate", Some(&Value::Object(body)), None, None).await
    }

    pub async fn list_risk_policies(&self, tenant_id: &str) -> Result<Value, Error> {
        let q = [("tenantId", tenant_id.to_string())];
        self.sc.request::<()>(Method::GET, "/risk/policies", None, Some(&q), None).await
    }
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct LoginRequest {
    pub email: String,
    pub password: String,
    #[serde(rename = "tenantId")]
    pub tenant_id: String,
}