Struct ServerSideCredentialAccessBoundaryGranter 

pub struct ServerSideCredentialAccessBoundaryGranter { /* private fields */ }

Exchanges a Google OAuth access token for a server-issued CAB token.

The bound grant is stable configuration. Construct another granter (or use ServerSideCredentialAccessBoundaryGranter::with_grant) for a different authorization decision. The server-side CAB exchange does not accept a requested lifetime, so reqsign_core::Granter::grant must be called with None.

The source must be a token-only Credential containing a Google-issued OAuth access token with a known absolute expiration and the https://www.googleapis.com/auth/cloud-platform scope. Server-issued CAB tokens support user and service-account principals. STS rejects tokens that already carry security attributes; the opaque token string does not expose enough information to detect its principal, scope, or existing attributes locally. Credentials with unknown expiration or an attached service account are rejected before STS I/O.

The returned Credential is token-only and can be consumed directly by the existing Google crate::RequestSigner. Every grant performs a new STS exchange; the service layer does not cache granted outputs.

Example

use std::time::Duration;

use reqsign_core::{Context, Granter, time::Timestamp};
use reqsign_google::{
    CredentialAccessBoundaryGrant, CredentialAccessBoundaryPermissions,
    ServerSideCredentialAccessBoundaryGranter, TokenCredentialProvider,
};

let source = TokenCredentialProvider::new("source-oauth-token")
    .with_expires_at(Timestamp::now() + Duration::from_secs(3600));
let grant = CredentialAccessBoundaryGrant::for_object_prefix(
    "example-bucket",
    "customer-a/",
    CredentialAccessBoundaryPermissions::OBJECT_VIEWER,
);
// Supply a Context configured with an HttpSend implementation.
let context = Context::new();
let credential = Granter::new(
    context,
    source,
    ServerSideCredentialAccessBoundaryGranter::new(grant),
)
.grant(None)
.await?;

Implementations

impl ServerSideCredentialAccessBoundaryGranter

pub fn new(grant: CredentialAccessBoundaryGrant) -> Self

Create a server-side granter for a bound Credential Access Boundary.

pub fn with_grant(self, grant: CredentialAccessBoundaryGrant) -> Self

Replace the bound grant.

Trait Implementations

impl Clone for ServerSideCredentialAccessBoundaryGranter

fn clone(&self) -> ServerSideCredentialAccessBoundaryGranter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServerSideCredentialAccessBoundaryGranter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl GrantCredential for ServerSideCredentialAccessBoundaryGranter

type Credential = Credential

Credential used as the source and returned as the granted result.

fn required_valid_until( &self, _credential: &Self::Credential, _expires_in: Option<Duration>, ) -> Timestamp

Return the timestamp through which the source credential must remain usable.

async fn grant_credential( &self, ctx: &Context, credential: &Self::Credential, expires_in: Option<Duration>, ) -> Result<Self::Credential>

Grant a bounded, expiring credential from an existing service credential.