securitydept-oauth-resource-server 0.2.0

OAuth Resource Server of SecurityDept, a layered authentication and authorization toolkit built as reusable Rust crates.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

use oauth2::TokenIntrospectionResponse;

use crate::{
    OAuthResourceServerError, OAuthResourceServerIntrospectionConfig, OAuthResourceServerMetadata,
    OAuthResourceServerResult, VerificationPolicy, VerifiedOpaqueToken,
};

pub(super) struct OAuthResourceServerVerifierIntrospection {
    config: OAuthResourceServerIntrospectionConfig,
}

impl OAuthResourceServerVerifierIntrospection {
    pub fn from_config(config: &OAuthResourceServerIntrospectionConfig) -> Self {
        Self {
            config: config.clone(),
        }
    }

    pub async fn introspect(
        &self,
        token: &str,
        provider: &securitydept_oauth_provider::OAuthProviderRuntime,
        policy: &VerificationPolicy,
    ) -> OAuthResourceServerResult<VerifiedOpaqueToken> {
        let metadata = provider.metadata().await?;
        let response = provider
            .introspect(
                self.config.client_id.as_deref().unwrap_or_default(),
                self.config.client_secret.as_deref(),
                token,
                self.config.token_type_hint.as_deref(),
            )
            .await?;

        let resource_metadata = OAuthResourceServerMetadata {
            issuer: metadata.issuer,
            jwks_uri: metadata.jwks_uri,
            introspection_url: metadata.introspection_endpoint,
        };

        validate_introspection_response(&response, &resource_metadata, policy)?;

        Ok(VerifiedOpaqueToken {
            response,
            metadata: resource_metadata,
        })
    }
}

fn validate_introspection_response(
    response: &openidconnect::core::CoreTokenIntrospectionResponse,
    metadata: &OAuthResourceServerMetadata,
    policy: &VerificationPolicy,
) -> OAuthResourceServerResult<()> {
    if !response.active() {
        return Err(OAuthResourceServerError::PolicyViolation {
            message: "Opaque token is not active".to_string(),
        });
    }

    if let Some(issuer) = response.iss()
        && issuer != metadata.issuer.as_str()
    {
        return Err(OAuthResourceServerError::PolicyViolation {
            message: format!(
                "Opaque token issuer mismatch: expected {}, got {issuer}",
                metadata.issuer
            ),
        });
    }

    if !policy.allowed_audiences().is_empty() {
        let audience = response
            .aud()
            .ok_or_else(|| OAuthResourceServerError::PolicyViolation {
                message: "Opaque token is missing audience".to_string(),
            })?;
        let has_match = audience.iter().any(|value| {
            policy
                .allowed_audiences()
                .iter()
                .any(|expected| expected == value)
        });
        if !has_match {
            return Err(OAuthResourceServerError::PolicyViolation {
                message: "Opaque token audience does not satisfy verifier policy".to_string(),
            });
        }
    }

    if !policy.required_scopes().is_empty() {
        let scopes =
            response
                .scopes()
                .ok_or_else(|| OAuthResourceServerError::PolicyViolation {
                    message: "Opaque token is missing scopes".to_string(),
                })?;
        let has_all = policy
            .required_scopes()
            .iter()
            .all(|required| scopes.iter().any(|scope| scope.as_ref() == required));
        if !has_all {
            return Err(OAuthResourceServerError::PolicyViolation {
                message: format!(
                    "Opaque token is missing one or more required scopes: {}",
                    policy.required_scopes().join(", ")
                ),
            });
        }
    }

    Ok(())
}