systemprompt-oauth 0.17.0

OAuth 2.0 / OIDC with PKCE, token introspection, and audience/issuer validation for systemprompt.io AI governance infrastructure. WebAuthn and JWT auth for the MCP governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

//! ID-JAG minting for the EMA issuer role.

use chrono::Utc;
use systemprompt_identifiers::ClientId;

use crate::error::OauthResult as Result;
use crate::services::validation::id_jag::IdJagClaims;

#[derive(Debug)]
pub struct IdJagGrant<'a> {
    pub sub: &'a str,
    pub email: Option<&'a str>,
    pub aud: &'a str,
    pub client_id: &'a str,
    pub scope: Option<&'a str>,
    pub ttl_secs: i64,
    pub issuer: &'a str,
}

/// # Errors
/// Fails if the signing key is unavailable or JWT encoding fails.
pub fn mint_id_jag(grant: &IdJagGrant<'_>) -> Result<String> {
    let now = Utc::now().timestamp();
    let claims = IdJagClaims {
        iss: grant.issuer.to_owned(),
        sub: grant.sub.to_owned(),
        aud: grant.aud.to_owned(),
        client_id: Some(ClientId::new(grant.client_id)),
        azp: None,
        jti: uuid::Uuid::new_v4().to_string(),
        exp: now + grant.ttl_secs,
        iat: now,
        scope: grant.scope.map(ToOwned::to_owned),
        email: grant.email.map(ToOwned::to_owned),
    };
    super::encode_id_jag_with_authority(&claims)
}