systemprompt_models/profile/
security.rs

1use std::path::PathBuf;
2
3use crate::auth::JwtAudience;
4use serde::{Deserialize, Serialize};
5
6/// Audiences the gateway's grant paths require to be present in
7/// [`SecurityConfig::allowed_resource_audiences`].
8///
9/// These are not RFC 8707 external resource URIs — they are the gateway's own
10/// internal protocol audiences that hardcoded scope guards depend on. The
11/// `client_credentials` grant rejects any `hook:*` scope that is not paired
12/// with `audience=hook`, so a profile that does not opt into the `"hook"`
13/// audience cannot mint plugin hook tokens for the bridge. Profile validation
14/// rejects bootstrap if any entry here is missing, so the error surfaces at
15/// the operator's YAML edit rather than at a downstream tenant's first call.
16pub const GATEWAY_REQUIRED_RESOURCE_AUDIENCES: &[&str] = &["hook"];
17
18const fn default_allow_registration() -> bool {
19    true
20}
21
22fn default_signing_key_path() -> PathBuf {
23    PathBuf::from("signing_key.pem")
24}
25
26#[derive(Debug, Clone, Serialize, Deserialize, schemars::JsonSchema)]
27#[serde(deny_unknown_fields)]
28pub struct SecurityConfig {
29    #[serde(rename = "jwt_issuer")]
30    pub issuer: String,
31
32    #[serde(rename = "jwt_access_token_expiration")]
33    pub access_token_expiration: i64,
34
35    #[serde(rename = "jwt_refresh_token_expiration")]
36    pub refresh_token_expiration: i64,
37
38    #[serde(rename = "jwt_audiences")]
39    pub audiences: Vec<JwtAudience>,
40
41    #[serde(default)]
42    pub allowed_resource_audiences: Vec<String>,
43
44    #[serde(default = "default_allow_registration")]
45    pub allow_registration: bool,
46
47    #[serde(default = "default_signing_key_path")]
48    pub signing_key_path: PathBuf,
49
50    #[serde(default, skip_serializing_if = "Vec::is_empty")]
51    pub trusted_issuers: Vec<TrustedIssuer>,
52}
53
54#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, schemars::JsonSchema)]
55#[serde(deny_unknown_fields)]
56pub struct TrustedIssuer {
57    pub issuer: String,
58    pub jwks_uri: String,
59    pub audience: String,
60}
systemprompt_models/profile/security.rs

systemprompt_models/profile/
security.rs
