oauth_toolkit/
jwt.rs

1//! Lightweight JWT helpers for HS256 operations.
2
3use serde::{Deserialize, Serialize};
4
5/// Errors for JWT operations.
6#[derive(Debug, thiserror::Error)]
7pub enum JwtError {
8    /// Token has expired.
9    #[error("token expired")]
10    Expired,
11
12    /// Token is invalid.
13    #[error("invalid token: {0}")]
14    Invalid(String),
15
16    /// A required claim is missing.
17    #[error("missing claim: {0}")]
18    MissingClaim(String),
19}
20
21/// Encode a claims struct as an HS256 JWT.
22pub fn encode_hs256(claims: &impl Serialize, secret: &str) -> Result<String, JwtError> {
23    let header = jsonwebtoken::Header::new(jsonwebtoken::Algorithm::HS256);
24    jsonwebtoken::encode(
25        &header,
26        claims,
27        &jsonwebtoken::EncodingKey::from_secret(secret.as_bytes()),
28    )
29    .map_err(|e| JwtError::Invalid(e.to_string()))
30}
31
32/// Decode and validate an HS256 JWT, returning typed claims.
33pub fn decode_hs256<T: for<'de> Deserialize<'de>>(
34    token: &str,
35    secret: &str,
36    issuer: Option<&str>,
37    audience: Option<&str>,
38) -> Result<T, JwtError> {
39    let mut validation = jsonwebtoken::Validation::new(jsonwebtoken::Algorithm::HS256);
40
41    if let Some(iss) = issuer {
42        validation.set_issuer(&[iss]);
43    }
44    if let Some(aud) = audience {
45        validation.set_audience(&[aud]);
46    }
47
48    jsonwebtoken::decode::<T>(
49        token,
50        &jsonwebtoken::DecodingKey::from_secret(secret.as_bytes()),
51        &validation,
52    )
53    .map(|data| data.claims)
54    .map_err(|e| match *e.kind() {
55        jsonwebtoken::errors::ErrorKind::ExpiredSignature => JwtError::Expired,
56        _ => JwtError::Invalid(e.to_string()),
57    })
58}
59
60/// Extract a Bearer token from an Authorization header value.
61pub fn extract_bearer_token(header_value: &str) -> Option<&str> {
62    header_value.strip_prefix("Bearer ").map(|t| t.trim())
63}
64
65/// Build a Set-Cookie header value for an auth token.
66pub fn build_auth_cookie(cookie_name: &str, token: &str, max_age_secs: i64) -> String {
67    format!("{cookie_name}={token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age={max_age_secs}")
68}
69
70#[cfg(test)]
71mod tests {
72    use super::*;
73    use serde::{Deserialize, Serialize};
74
75    #[derive(Debug, Serialize, Deserialize, PartialEq)]
76    struct TestClaims {
77        sub: String,
78        exp: usize,
79        iat: usize,
80    }
81
82    #[test]
83    fn encode_decode_roundtrip() {
84        let claims = TestClaims {
85            sub: "user123".into(),
86            exp: 9999999999,
87            iat: 1000000000,
88        };
89        let token = encode_hs256(&claims, "secret-key-1234567890123456").unwrap();
90        let decoded: TestClaims =
91            decode_hs256(&token, "secret-key-1234567890123456", None, None).unwrap();
92        assert_eq!(decoded, claims);
93    }
94
95    #[test]
96    fn decode_wrong_secret_fails() {
97        let claims = TestClaims {
98            sub: "user123".into(),
99            exp: 9999999999,
100            iat: 1000000000,
101        };
102        let token = encode_hs256(&claims, "secret1").unwrap();
103        assert!(decode_hs256::<TestClaims>(&token, "secret2", None, None).is_err());
104    }
105
106    #[test]
107    fn extract_bearer_token_valid() {
108        assert_eq!(extract_bearer_token("Bearer abc123"), Some("abc123"));
109    }
110
111    #[test]
112    fn extract_bearer_token_missing() {
113        assert!(extract_bearer_token("Basic abc123").is_none());
114    }
115
116    #[test]
117    fn build_auth_cookie_format() {
118        let cookie = build_auth_cookie("session", "tok123", 3600);
119        assert!(cookie.contains("session=tok123"));
120        assert!(cookie.contains("HttpOnly"));
121        assert!(cookie.contains("Secure"));
122        assert!(cookie.contains("Max-Age=3600"));
123    }
124}
oauth_toolkit/jwt.rs

oauth_toolkit/
jwt.rs
