Struct ClientSideCredentialAccessBoundaryGranter 

pub struct ClientSideCredentialAccessBoundaryGranter { /* private fields */ }

Exchanges source credentials for intermediary material and generates Google Credential Access Boundary tokens locally.

The granter exchanges the source OAuth access token for an access-boundary intermediary token and session key when the cached intermediary no longer covers the requested lifetime, then creates every downscoped credential locally. It does not spawn background work; the first caller that needs a refresh performs the exchange. Refreshes for the same source authority, expiration, and endpoint are serialized, while unrelated partitions can proceed independently. After a failed refresh, the next waiting caller retries instead of receiving cached failure state. Clones and values produced with ClientSideCredentialAccessBoundaryGranter::with_grant share a bounded intermediary cache partitioned by the source token authority, its declared expiration, and the Google STS endpoint. Cancellation never installs a partially fetched intermediary, and refresh-lock registry entries live only while callers for that partition are active.

Each call performs fresh authenticated encryption and returns a distinct, token-only Credential. The output expiration exactly matches the intermediary expiration. The optional lifetime passed to reqsign_core::Granter::grant is treated as the minimum remaining output lifetime; it does not shorten the token. None uses the 30-minute default, which can be changed with ClientSideCredentialAccessBoundaryGranter::with_minimum_token_lifetime.

The source must be a token-only Google OAuth access token for a service account, with a known absolute expiration and the Cloud Platform scope. Client-issued CAB tokens do not support user principals. STS rejects tokens that already carry security attributes; the opaque source token does not expose enough information to detect its principal, scope, or existing attributes locally. An intermediary response without expires_in, which STS uses for user access-token sources, is rejected.

Google currently returns a serialized Tink AEAD keyset as the session key. This implementation accepts enabled primary AES-GCM keys and fails closed for other key types.

Example

use std::time::Duration;

use reqsign_core::{Context, Granter, time::Timestamp};
use reqsign_google::{
    ClientSideCredentialAccessBoundaryGranter, CredentialAccessBoundaryGrant,
    CredentialAccessBoundaryPermissions, TokenCredentialProvider,
};

let source = TokenCredentialProvider::new("source-oauth-token")
    .with_expires_at(Timestamp::now() + Duration::from_secs(3600));
let grant = CredentialAccessBoundaryGrant::for_object_prefix(
    "example-bucket",
    "customer-a/",
    CredentialAccessBoundaryPermissions::OBJECT_VIEWER,
);
// Supply a Context configured with an HttpSend implementation.
let context = Context::new();
let credential = Granter::new(
    context,
    source,
    ClientSideCredentialAccessBoundaryGranter::new(grant),
)
.grant(None)
.await?;

Implementations

impl ClientSideCredentialAccessBoundaryGranter

pub fn new(grant: CredentialAccessBoundaryGrant) -> Self

Create a granter for a bound Credential Access Boundary.

pub fn with_grant(self, grant: CredentialAccessBoundaryGrant) -> Self

Replace the bound grant while retaining the shared intermediary cache.

pub fn with_minimum_token_lifetime(self, lifetime: Duration) -> Self

Set the minimum remaining lifetime for outputs granted without an explicit per-call lifetime.

The value is rounded up to a whole second and must then be greater than zero and strictly less than twelve hours. The largest accepted value is 11 hours, 59 minutes, and 59 seconds. Validation occurs before STS I/O.

Trait Implementations

impl Clone for ClientSideCredentialAccessBoundaryGranter

fn clone(&self) -> ClientSideCredentialAccessBoundaryGranter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClientSideCredentialAccessBoundaryGranter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl GrantCredential for ClientSideCredentialAccessBoundaryGranter

type Credential = Credential

Credential used as the source and returned as the granted result.

fn required_valid_until( &self, _credential: &Self::Credential, expires_in: Option<Duration>, ) -> Timestamp

Return the timestamp through which the source credential must remain usable.

async fn grant_credential( &self, ctx: &Context, credential: &Self::Credential, expires_in: Option<Duration>, ) -> Result<Self::Credential>

Grant a bounded, expiring credential from an existing service credential.