rskit-auth 0.2.0-alpha.1

JWT, OIDC, password hashing, and request-context auth helpers
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

#![allow(
    missing_docs,
    clippy::derive_partial_eq_without_eq,
    clippy::redundant_pub_crate
)]

use std::time::{SystemTime, UNIX_EPOCH};

use rskit_auth::{JwtConfig, JwtService};
use serde::{Deserialize, Serialize};

pub(crate) const ISSUER: &str = "https://issuer.rskit.test";
pub(crate) const AUDIENCE: &str = "rskit-auth-tests";

pub(crate) fn now_epoch() -> u64 {
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs()
}

pub(crate) fn future_exp() -> u64 {
    now_epoch() + 3600
}

pub(crate) fn standard_config(secret: &str) -> JwtConfig {
    // Pad short secrets to the 32-byte minimum required by the HMAC key validator.
    let padded;
    let key = if secret.len() < 32 {
        padded = format!("{secret:-<32}");
        padded.as_str()
    } else {
        secret
    };
    JwtConfig::hs256_internal(key, ISSUER, vec![AUDIENCE.to_string()])
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
pub(crate) struct StandardClaims {
    pub(crate) sub: String,
    pub(crate) iss: String,
    pub(crate) aud: Vec<String>,
    pub(crate) exp: u64,
    pub(crate) nbf: u64,
    pub(crate) iat: u64,
}

impl StandardClaims {
    pub(crate) fn new(sub: impl Into<String>) -> Self {
        let now = now_epoch();
        Self {
            sub: sub.into(),
            iss: ISSUER.into(),
            aud: vec![AUDIENCE.into()],
            exp: future_exp(),
            nbf: now.saturating_sub(1),
            iat: now,
        }
    }
}

pub(crate) fn jwt_service(secret: &str) -> JwtService<StandardClaims> {
    JwtService::new(standard_config(secret)).unwrap()
}