systemprompt-oauth 0.22.0

OAuth 2.0 / OIDC with PKCE, token introspection, and audience/issuer validation for systemprompt.io AI governance infrastructure. WebAuthn and JWT auth for the MCP governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

//! ID-JAG minting for the EMA issuer role.
//!
//! Copyright (c) systemprompt.io — Business Source License 1.1.
//! See <https://systemprompt.io> for licensing details.

use chrono::Utc;
use systemprompt_identifiers::ClientId;

use crate::error::OauthResult as Result;
use crate::services::validation::id_jag::IdJagClaims;

#[derive(Debug)]
pub struct IdJagGrant<'a> {
    pub sub: &'a str,
    pub email: Option<&'a str>,
    pub aud: &'a str,
    pub client_id: &'a ClientId,
    pub scope: Option<&'a str>,
    pub ttl_secs: i64,
    pub issuer: &'a str,
}

pub fn mint_id_jag(grant: &IdJagGrant<'_>) -> Result<String> {
    let now = Utc::now().timestamp();
    let claims = IdJagClaims {
        iss: grant.issuer.to_owned(),
        sub: grant.sub.to_owned(),
        aud: grant.aud.to_owned(),
        client_id: Some(grant.client_id.clone()),
        azp: None,
        jti: uuid::Uuid::new_v4().to_string(),
        exp: now + grant.ttl_secs,
        iat: now,
        scope: grant.scope.map(ToOwned::to_owned),
        email: grant.email.map(ToOwned::to_owned),
    };
    super::encode_id_jag_with_authority(&claims)
}