tame_oauth/
id_token.rs

1use std::time::SystemTime;
2
3use crate::{token::RequestReason, token_cache::CacheableToken, Error};
4
5/// Represents a id token as returned by `OAuth2` servers.
6#[derive(Clone, PartialEq, Eq, Debug)]
7pub struct IdToken {
8    pub token: String,
9    pub expiration: SystemTime,
10}
11
12impl IdToken {
13    pub fn new(token: String) -> Result<IdToken, Error> {
14        // Extract the exp claim from the token, so we can know if the token is expired or not.
15        let claims = token.split('.').nth(1).ok_or(Error::InvalidTokenFormat)?;
16
17        let decoded = data_encoding::BASE64URL_NOPAD.decode(claims.as_bytes())?;
18        let claims: TokenClaims = serde_json::from_slice(&decoded)?;
19
20        Ok(Self {
21            token,
22            expiration: SystemTime::UNIX_EPOCH
23                .checked_add(std::time::Duration::from_secs(claims.exp))
24                .unwrap_or(SystemTime::UNIX_EPOCH),
25        })
26    }
27}
28
29impl CacheableToken for IdToken {
30    /// Returns true if token is expired.
31    #[inline]
32    fn has_expired(&self) -> bool {
33        if self.token.is_empty() {
34            return true;
35        }
36
37        self.expiration <= SystemTime::now()
38    }
39}
40
41/// Either a valid token, or an HTTP request. With some token sources, two different
42/// HTTP requests needs to be performed, one to get an access token and one to get
43/// the actual id token.
44pub enum IdTokenOrRequest {
45    AccessTokenRequest {
46        request: AccessTokenRequest,
47        reason: RequestReason,
48        audience_hash: u64,
49    },
50    IdTokenRequest {
51        request: IdTokenRequest,
52        reason: RequestReason,
53        audience_hash: u64,
54    },
55    IdToken(IdToken),
56}
57
58pub type IdTokenRequest = http::Request<Vec<u8>>;
59pub type AccessTokenRequest = http::Request<Vec<u8>>;
60
61pub type AccessTokenResponse<S> = http::Response<S>;
62pub type IdTokenResponse<S> = http::Response<S>;
63
64/// A `IdTokenProvider` supplies all methods needed for all different flows to get a id token.
65pub trait IdTokenProvider {
66    /// Attempts to retrieve an id token that can be used when communicating via IAP etc.
67    fn get_id_token(&self, audience: &str) -> Result<IdTokenOrRequest, Error>;
68
69    /// Some token sources require a access token to be used to generte a id token.
70    /// If `get_id_token` returns a `AccessTokenResponse`, this method should be called.
71    fn get_id_token_with_access_token<S>(
72        &self,
73        audience: &str,
74        response: AccessTokenResponse<S>,
75    ) -> Result<IdTokenRequest, Error>
76    where
77        S: AsRef<[u8]>;
78
79    /// Once a `IdTokenResponse` has been received for an id token request, call this method
80    /// to deserialize the token.
81    fn parse_id_token_response<S>(
82        &self,
83        hash: u64,
84        response: IdTokenResponse<S>,
85    ) -> Result<IdToken, Error>
86    where
87        S: AsRef<[u8]>;
88}
89
90#[derive(serde::Deserialize, Debug)]
91struct TokenClaims {
92    exp: u64,
93}
94
95#[cfg(test)]
96mod tests {
97    use std::time::SystemTime;
98
99    use super::IdToken;
100
101    #[test]
102    fn test_decode_jwt() {
103        /* raw token claims
104        {
105            "aud": "my-aud",
106            "azp": "123",
107            "email": "test@example.com",
108            "email_verified": true,
109            "exp": 1676641773,
110            "iat": 1676638173,
111            "iss": "https://accounts.google.com",
112            "sub": "1234",
113            "key": "~~~?"
114        }
115        */
116
117        let raw_token = "eyJhbGciOiJSUzI1NiIsImtpZCI6ImFiYzEyMyIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJteS1hdWQiLCJhenAiOiIxMjMiLCJlbWFpbCI6InRlc3RAZXhhbXBsZS5jb20iLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiZXhwIjoxNjc2NjQxNzczLCJpYXQiOjE2NzY2MzgxNzMsImlzcyI6Imh0dHBzOi8vYWNjb3VudHMuZ29vZ2xlLmNvbSIsInN1YiI6IjEyMzQiLCJrZXkiOiJ-fn4_In0.RpaD4p5ugL-MH_bkQ3jQ6RPANCDl1nV32xbE5raJF7tZkteQG4ULfRAcVsRnhF3j0yw3e8X9WJJ0rBdnF79MxYbaGB61hl8i6vjoa13zuEw2yaY-pNfEkfsqyf0WcY80_uV3jt-vmcPAlikgtss1YCVl9SW3i2bFXTw_kV-UE8stuCjNcjkORI9hZxEoYZoDJcc4Y8W7JuYD8V8fF8iBtZLCtGCPK64ERrZFkTqLX6FcypEAo6Y5JvmrKGQSMx9q8ozkpqMRTxxfPw6HVTEQJacjkkdJoCrs3zARzzjvm1xyWfJSGGS_g4wismCbDKLtsCSNmugjS-7ruf7rnqUTBg";
118
119        // Make sure that the claims part base64 is encoded without padding, this is to make sure that padding is handled correctly.
120        // Note that when changing the test token, this might fail, in that case, just add a character somewhere in the claims.
121        let claims = raw_token.split('.').nth(1).unwrap();
122        assert_ne!(claims.len() % 4, 0);
123
124        // assert that the test token includes url safe encoded characters in the base64 encoded claims part
125        assert!(claims.contains('_'));
126        assert!(claims.contains('-'));
127
128        let id_token = IdToken::new(raw_token.to_owned()).unwrap();
129
130        assert_eq!(id_token.token, raw_token);
131        assert_eq!(
132            id_token
133                .expiration
134                .duration_since(SystemTime::UNIX_EPOCH)
135                .unwrap()
136                .as_secs(),
137            1676641773
138        );
139    }
140}
tame_oauth/id_token.rs

tame_oauth/
id_token.rs
