systemprompt-oauth 0.9.1

OAuth 2.0 / OIDC with PKCE, token introspection, and audience/issuer validation for systemprompt.io AI governance infrastructure. WebAuthn and JWT auth for the MCP governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

//! Runtime `WebAuthn` relying-party configuration.

use std::time::Duration;
use systemprompt_models::Config;
use webauthn_rs::prelude::*;

#[derive(Debug, Clone)]
pub struct WebAuthnConfig {
    pub rp_id: String,
    pub rp_origin: Url,
    pub rp_name: String,
    pub challenge_expiry: Duration,
    pub allow_any_port: bool,
    pub allow_subdomains: bool,
}

impl WebAuthnConfig {
    pub fn new() -> crate::error::OauthResult<Self> {
        let config = Config::get()?;
        let api_url = &config.api_external_url;
        let parsed_url = Url::parse(api_url).map_err(|e| {
            crate::error::OauthError::from(anyhow::anyhow!("API_EXTERNAL_URL invalid: {}", e))
        })?;

        let rp_id = parsed_url
            .host_str()
            .ok_or_else(|| {
                crate::error::OauthError::from(anyhow::anyhow!(
                    "API_EXTERNAL_URL must contain a valid host for WebAuthn RP ID"
                ))
            })?
            .to_string();

        Ok(Self {
            rp_id,
            rp_origin: parsed_url,
            rp_name: format!("{} OAuth", config.sitename),
            challenge_expiry: Duration::from_secs(
                crate::constants::webauthn::CHALLENGE_EXPIRY_SECONDS,
            ),
            allow_any_port: true,
            allow_subdomains: true,
        })
    }

    pub fn with_rp_id(mut self, rp_id: impl Into<String>) -> Self {
        self.rp_id = rp_id.into();
        self
    }

    pub fn with_rp_origin(mut self, rp_origin: Url) -> Self {
        self.rp_origin = rp_origin;
        self
    }

    pub fn with_rp_name(mut self, rp_name: impl Into<String>) -> Self {
        self.rp_name = rp_name.into();
        self
    }

    pub const fn with_challenge_expiry(mut self, expiry: Duration) -> Self {
        self.challenge_expiry = expiry;
        self
    }

    pub const fn with_any_port(mut self, allow: bool) -> Self {
        self.allow_any_port = allow;
        self
    }

    pub const fn with_subdomains(mut self, allow: bool) -> Self {
        self.allow_subdomains = allow;
        self
    }

    pub fn challenge_expiry_chrono(&self) -> chrono::Duration {
        chrono::Duration::from_std(self.challenge_expiry)
            .unwrap_or_else(|_| chrono::Duration::minutes(5))
    }
}