systemprompt_api/routes/oauth/endpoints/token/
mod.rs

1//! OAuth 2.0 token endpoint.
2//!
3//! Hosts the `/token` handler and the request/response types
4//! ([`TokenRequest`], [`TokenResponse`]) it binds. Per-grant token minting
5//! lives in [`generation`]; [`TokenError`] partitions failures by RFC 6749
6//! error code and maps onto the HTTP error surface.
7//!
8//! Copyright (c) systemprompt.io — Business Source License 1.1.
9//! See <https://systemprompt.io> for licensing details.
10
11pub mod generation;
12mod handler;
13pub mod validation;
14
15pub use handler::handle_token;
16
17#[cfg(feature = "test-api")]
18pub use handler::test_api as handler_test_api;
19
20use serde::{Deserialize, Serialize};
21
22use crate::routes::oauth::OAuthHttpError;
23
24pub type TokenResult<T> = Result<T, TokenError>;
25
26#[derive(Debug, Deserialize)]
27pub struct TokenRequest {
28    pub grant_type: String,
29    pub code: Option<String>,
30    pub redirect_uri: Option<String>,
31    pub client_id: Option<String>,
32    pub client_secret: Option<String>,
33    pub refresh_token: Option<String>,
34    pub scope: Option<String>,
35    pub code_verifier: Option<String>,
36    pub resource: Option<String>,
37    pub plugin_id: Option<String>,
38    pub audience: Option<String>,
39    pub subject_token: Option<String>,
40    pub subject_token_type: Option<String>,
41    pub actor_token: Option<String>,
42    pub actor_token_type: Option<String>,
43    pub requested_token_type: Option<String>,
44}
45
46#[derive(Debug, Serialize)]
47pub struct TokenResponse {
48    pub access_token: String,
49    pub token_type: String,
50    pub expires_in: i64,
51    #[serde(skip_serializing_if = "Option::is_none")]
52    pub refresh_token: Option<String>,
53    #[serde(skip_serializing_if = "Option::is_none")]
54    pub scope: Option<String>,
55    // Why: RFC 8693 §2.2.1 issued_token_type. Only set by the
56    // urn:ietf:params:oauth:grant-type:token-exchange flow.
57    #[serde(skip_serializing_if = "Option::is_none")]
58    pub issued_token_type: Option<String>,
59}
60
61#[derive(Debug, thiserror::Error)]
62pub enum TokenError {
63    #[error("Invalid request: {field} {message}")]
64    InvalidRequest { field: String, message: String },
65
66    #[error("Unsupported grant type: {grant_type}")]
67    UnsupportedGrantType { grant_type: String },
68
69    #[error("Invalid client credentials")]
70    InvalidClient,
71
72    #[error("Invalid authorization code: {reason}")]
73    InvalidGrant { reason: String },
74
75    #[error("Invalid refresh token: {reason}")]
76    InvalidRefreshToken { reason: String },
77
78    #[error("Invalid credentials")]
79    InvalidCredentials,
80
81    #[error("Invalid client secret")]
82    InvalidClientSecret,
83
84    #[error("Authorization code expired")]
85    ExpiredCode,
86
87    #[error("Server error: {message}")]
88    ServerError { message: String },
89
90    #[error("Invalid target resource: {message}")]
91    InvalidTarget { message: String },
92
93    #[error("Invalid scope: {message}")]
94    InvalidScope { message: String },
95}
96
97impl From<TokenError> for OAuthHttpError {
98    fn from(error: TokenError) -> Self {
99        match error {
100            TokenError::InvalidRequest { field, message } => {
101                Self::invalid_request(format!("{field}: {message}"))
102            },
103            TokenError::UnsupportedGrantType { grant_type } => {
104                Self::unsupported_grant_type(format!("Grant type '{grant_type}' is not supported"))
105            },
106            TokenError::InvalidClient => Self::invalid_client("Client authentication failed"),
107            TokenError::InvalidGrant { reason } => Self::invalid_grant(reason),
108            TokenError::InvalidRefreshToken { reason } => {
109                Self::invalid_grant(format!("Refresh token invalid: {reason}"))
110            },
111            TokenError::InvalidCredentials => Self::invalid_grant("Invalid credentials"),
112            TokenError::InvalidClientSecret => Self::invalid_client("Invalid client secret"),
113            TokenError::ExpiredCode => Self::invalid_grant("Authorization code expired"),
114            TokenError::ServerError { message } => Self::server_error(message),
115            TokenError::InvalidTarget { message } => Self::invalid_target(message),
116            TokenError::InvalidScope { message } => Self::invalid_scope(message),
117        }
118    }
119}
systemprompt_api/routes/oauth/endpoints/token/mod.rs

systemprompt_api/routes/oauth/endpoints/token/
mod.rs
