systemprompt-oauth 0.9.2

OAuth 2.0 / OIDC with PKCE, token introspection, and audience/issuer validation for systemprompt.io AI governance infrastructure. WebAuthn and JWT auth for the MCP governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

//! JWT-based authentication service entry point.

use crate::services::validation::jwt as jwt_validation;
use http::{HeaderMap, StatusCode};
use systemprompt_models::auth::AuthenticatedUser;
use systemprompt_security::TokenExtractor;
use uuid::Uuid;

#[derive(Debug, Copy, Clone)]
pub struct AuthenticationService;

impl AuthenticationService {
    pub fn authenticate(headers: &HeaderMap) -> Result<AuthenticatedUser, StatusCode> {
        let token = TokenExtractor::standard()
            .extract(headers)
            .map_err(|_| StatusCode::UNAUTHORIZED)?;
        let jwt_secret = systemprompt_config::SecretsBootstrap::jwt_secret()
            .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
        let config =
            systemprompt_models::Config::get().map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;

        let claims = jwt_validation::validate_jwt_token(
            &token,
            jwt_secret,
            &config.jwt_issuer,
            &config.jwt_audiences,
        )
        .map_err(|_| StatusCode::UNAUTHORIZED)?;

        let user_id = Uuid::parse_str(&claims.sub).map_err(|_| StatusCode::UNAUTHORIZED)?;
        let permissions = claims.get_permissions();
        let roles = claims.roles().to_vec();

        Ok(AuthenticatedUser::new_with_roles(
            user_id,
            claims.username.clone(),
            claims.email,
            permissions,
            roles,
        ))
    }
}