graph_core/identity/
jwk.rs

1use serde_json::Value;
2use std::collections::{HashMap, HashSet};
3use std::fmt::{Display, Formatter};
4use std::hash::{Hash, Hasher};
5use url::Url;
6
7/// JSON Web Key (JWK) is a JSON object that represents a cryptographic key.
8/// The members of the object represent properties of the key, including its value.
9/// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4)
10#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
11pub struct JsonWebKey {
12    /// The "kty" (key type) parameter identifies the cryptographic algorithm family used with
13    /// the key, such as "RSA" or "EC".  "kty" values should either be registered in the
14    /// IANA "JSON Web Key Types" registry established by [JWA] or be a value that contains
15    /// a Collision-Resistant Name.  The "kty" value is a case-sensitive string.
16    /// This member MUST be present in a JWK.
17    /// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4.1)
18    pub kty: String,
19
20    /// The "use" (public key use) parameter identifies the intended use of the public key.
21    /// The "use" parameter is employed to indicate whether a public key is used for encrypting
22    /// data or verifying the signature on data.
23    /// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4.2)
24    #[serde(alias = "use")]
25    pub _use: Option<String>,
26    /// The "key_ops" (key operations) parameter identifies the operation(s) for which the key
27    /// is intended to be used.  The "key_ops" parameter is intended for use cases in which
28    /// public, private, or symmetric keys may be present.
29    /// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4.3)
30    pub key_ops: Vec<String>,
31
32    /// The "alg" (algorithm) parameter identifies the algorithm intended for use with the key.
33    /// The values used should either be registered in the IANA "JSON Web Signature and
34    /// Encryption Algorithms" registry established by JWA or be a value that contains
35    /// a Collision-Resistant Name.  The "alg" value is a case-sensitive ASCII string.
36    /// Use of this member is OPTIONAL.
37    /// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4.4)
38    pub alg: Option<String>,
39
40    /// The "kid" (key ID) parameter is used to match a specific key.
41    /// This is used, for instance, to choose among a set of keys within a JWK Set during key
42    /// rollover.  The structure of the "kid" value is unspecified.
43    /// When "kid" values are used within a JWK Set, different keys within the JWK Set SHOULD
44    /// use distinct "kid" values.  (One example in which different keys might use the
45    /// same "kid" value is if they have different "kty" (key type) values but are considered
46    /// to be equivalent alternatives by the application using them.)
47    /// The "kid" value is a case-sensitive string.  Use of this member is OPTIONAL.
48    /// When used with JWS or JWE, the "kid" value is used to match a JWS or JWE "kid"
49    /// Header Parameter value.
50    /// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4.5)
51    pub kid: Option<String>,
52
53    /// The "x5u" (X.509 URL) parameter is a URI that refers to a resource for
54    /// an X.509 public key certificate or certificate chain
55    /// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4.6)
56    pub x5u: Option<Url>,
57
58    /// The "x5c" (X.509 certificate chain) parameter contains a chain of one or more
59    /// PKIX certificates [RFC5280](https://datatracker.ietf.org/doc/html/rfc5280).
60    /// The certificate chain is represented as a JSON array of certificate value strings.
61    /// Each string in the array is a base64-encoded (Section 4 of
62    /// [RFC4648](https://datatracker.ietf.org/doc/html/rfc4648#section-4)
63    /// -- not base64url-encoded) DER
64    /// [ITU.X690.1994](https://datatracker.ietf.org/doc/html/rfc7517#ref-ITU.X690.1994)
65    /// PKIX certificate value. The PKIX certificate containing the key value MUST be the first
66    /// certificate. This MAY be followed by additional certificates, with each subsequent
67    /// certificate being the one used to certify the previous one.  The key in the first
68    /// certificate MUST match the public key represented by other members of the JWK.
69    /// Use of this member is OPTIONAL.
70    /// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4.7)
71    pub x5c: Option<String>,
72
73    /// The "x5t" (X.509 certificate SHA-1 thumbprint) parameter is a base64url-encoded
74    /// SHA-1 thumbprint (a.k.a. digest) of the DER encoding of an X.509 certificate [RFC5280]
75    /// Note that certificate thumbprints are also sometimes known as certificate fingerprints.
76    /// The key in the certificate MUST match the public key represented by
77    /// other members of the JWK. Use of this member is OPTIONAL
78    /// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4.8)
79    pub x5t: Option<String>,
80
81    /// The "x5t#S256" (X.509 certificate SHA-256 thumbprint) parameter is a base64url-encoded
82    /// SHA-256 thumbprint (a.k.a. digest) of the DER encoding of an X.509 certificate Note that
83    /// certificate thumbprints are also sometimes known as certificate fingerprints.
84    /// The key in the certificate MUST match the public key represented by other members of
85    /// the JWK. Use of this member is OPTIONAL.
86    /// [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517#section-4.9)
87    #[serde(alias = "x5t#S256")]
88    pub x5t_s256: Option<String>,
89
90    #[serde(flatten)]
91    pub additional_fields: HashMap<String, Value>,
92}
93
94impl Hash for JsonWebKey {
95    fn hash<H: Hasher>(&self, state: &mut H) {
96        self.kty.hash(state);
97        self._use.hash(state);
98    }
99}
100
101impl Display for JsonWebKey {
102    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
103        write!(f, "kty: {}, use: {:#?}, key_ops: {:#?}, alg: {:#?}, kid: {:#?}, x5u: {:#?}, x5c: {:#?}, x5t: {:#?}, x5t#S256: {:#?}",
104               self.kty, self._use, self.key_ops, self.alg, self.kid, self.x5u, self.x5c, self.x5t, self.x5t_s256 )
105    }
106}
107
108/// A JSON Web Key Set (JWKS) is a JSON object that represents a set of JWKs. The JSON object MUST
109/// have a "keys" member, which is an array of JWKs.
110#[derive(Clone, Debug, Serialize, Deserialize)]
111pub struct JsonWebKeySet {
112    pub keys: HashSet<JsonWebKey>,
113}
114
115impl Display for JsonWebKeySet {
116    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
117        write!(f, "keys: {:#?}", self.keys)
118    }
119}
graph_core/identity/jwk.rs

graph_core/identity/
jwk.rs
