systemprompt_models/profile/
security.rs

1use std::path::PathBuf;
2
3use crate::auth::JwtAudience;
4use serde::{Deserialize, Serialize};
5
6/// Audiences the gateway's grant paths require to be present in
7/// [`SecurityConfig::allowed_resource_audiences`].
8///
9/// These are not RFC 8707 external resource URIs — they are the gateway's own
10/// internal protocol audiences that hardcoded scope guards depend on. The
11/// `client_credentials` grant rejects any `hook:*` scope that is not paired
12/// with `audience=hook`, so a profile that does not opt into the `"hook"`
13/// audience cannot mint plugin hook tokens for the bridge. Profile validation
14/// rejects bootstrap if any entry here is missing, so the error surfaces at
15/// the operator's YAML edit rather than at a downstream tenant's first call.
16pub const GATEWAY_REQUIRED_RESOURCE_AUDIENCES: &[&str] = &["hook"];
17
18/// The resource audiences every generated profile must opt into.
19///
20/// Returns [`GATEWAY_REQUIRED_RESOURCE_AUDIENCES`] as owned strings, so the
21/// setup wizard and the env-driven cloud bootstrap seed the same audiences and
22/// pass [`crate::profile::Profile::validate`] from one source of truth.
23#[must_use]
24pub fn default_resource_audiences() -> Vec<String> {
25    GATEWAY_REQUIRED_RESOURCE_AUDIENCES
26        .iter()
27        .map(|aud| (*aud).to_owned())
28        .collect()
29}
30
31const fn default_allow_registration() -> bool {
32    true
33}
34
35fn default_signing_key_path() -> PathBuf {
36    PathBuf::from("signing_key.pem")
37}
38
39/// Default ID-JAG lifetime in seconds; short by design (draft §6) to bound
40/// replay.
41pub const DEFAULT_ID_JAG_TTL_SECS: i64 = 300;
42
43const fn default_id_jag_ttl_secs() -> i64 {
44    DEFAULT_ID_JAG_TTL_SECS
45}
46
47#[derive(Debug, Clone, Serialize, Deserialize, schemars::JsonSchema)]
48#[serde(deny_unknown_fields)]
49pub struct SecurityConfig {
50    #[serde(rename = "jwt_issuer")]
51    pub issuer: String,
52
53    #[serde(rename = "jwt_access_token_expiration")]
54    pub access_token_expiration: i64,
55
56    #[serde(rename = "jwt_refresh_token_expiration")]
57    pub refresh_token_expiration: i64,
58
59    #[serde(rename = "jwt_audiences")]
60    pub audiences: Vec<JwtAudience>,
61
62    #[serde(default)]
63    pub allowed_resource_audiences: Vec<String>,
64
65    #[serde(default = "default_allow_registration")]
66    pub allow_registration: bool,
67
68    #[serde(default = "default_signing_key_path")]
69    pub signing_key_path: PathBuf,
70
71    #[serde(default, skip_serializing_if = "Vec::is_empty")]
72    pub trusted_issuers: Vec<TrustedIssuer>,
73
74    #[serde(default = "default_id_jag_ttl_secs")]
75    pub id_jag_ttl_secs: i64,
76}
77
78/// A federated identity provider trusted for the RFC 8693 token-exchange and
79/// EMA (Enterprise-Managed Authorization) paths.
80///
81/// `audience` holds the value the `IdP` places in `id_token.aud`; for a
82/// Salesforce Connected App that is its `client_id`, **not** a URL.
83#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, schemars::JsonSchema)]
84#[serde(deny_unknown_fields)]
85pub struct TrustedIssuer {
86    pub issuer: String,
87    pub jwks_uri: String,
88    pub audience: String,
89
90    /// Accepted JOSE `typ` header values; empty accepts any.
91    #[serde(default, skip_serializing_if = "Vec::is_empty")]
92    pub typ_allowlist: Vec<String>,
93
94    /// `client_id`/`azp` values accepted on the EMA consume path; empty accepts
95    /// any.
96    #[serde(default, skip_serializing_if = "Vec::is_empty")]
97    pub allowed_client_ids: Vec<String>,
98
99    /// Whether this issuer's `id_token` may seed the EMA ID-JAG issuance path.
100    #[serde(default)]
101    pub can_issue_id_jag: bool,
102}
systemprompt_models/profile/security.rs

systemprompt_models/profile/
security.rs
