BasicOIDC/src/data/id_token.rs

use jwt_simple::claims::Audiences;
use jwt_simple::prelude::{Duration, JWTClaims};

#[derive(serde::Serialize)]
pub struct IdToken {
    /// REQUIRED. Issuer Identifier for the Issuer of the response. The iss value is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components.
    #[serde(rename = "iss")]
    pub issuer: String,
    /// REQUIRED. Subject Identifier. A locally unique and never reassigned identifier within the Issuer for the End-User, which is intended to be consumed by the Client, e.g., 24400320 or AItOawmwtWwcT0k51BayewNvutrJUqsvl6qs7A4. It MUST NOT exceed 255 ASCII characters in length. The sub value is a case sensitive string.
    #[serde(rename = "sub")]
    pub subject_identifier: String,
    /// REQUIRED. Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value. It MAY also contain identifiers for other audiences. In the general case, the aud value is an array of case sensitive strings. In the common special case when there is one audience, the aud value MAY be a single case sensitive string.
    #[serde(rename = "aud")]
    pub audience: String,
    /// REQUIRED. Expiration time on or after which the ID Token MUST NOT be accepted for processing. The processing of this parameter requires that the current date/time MUST be before the expiration date/time listed in the value. Implementers MAY provide for some small leeway, usually no more than a few minutes, to account for clock skew. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time. See RFC 3339 [RFC3339] for details regarding date/times in general and UTC in particular.
    #[serde(rename = "exp")]
    pub expiration_time: u64,
    /// REQUIRED. Time at which the JWT was issued. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time.
    #[serde(rename = "iat")]
    pub issued_at: u64,
    /// Time when the End-User authentication occurred. Its value is a JSON number representing the number of seconds from 1970-01-01T0:0:0Z as measured in UTC until the date/time. When a max_age request is made or when auth_time is requested as an Essential Claim, then this Claim is REQUIRED; otherwise, its inclusion is OPTIONAL. (The auth_time Claim semantically corresponds to the OpenID 2.0 PAPE [OpenID.PAPE] auth_time response parameter.)
    pub auth_time: u64,
    /// String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. If present in the ID Token, Clients MUST verify that the nonce Claim Value is equal to the value of the nonce parameter sent in the Authentication Request. If present in the Authentication Request, Authorization Servers MUST include a nonce Claim in the ID Token with the Claim Value being the nonce value sent in the Authentication Request. Authorization Servers SHOULD perform no other processing on nonce values used. The nonce value is a case sensitive string.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub nonce: Option<String>,
}

#[derive(serde::Serialize, serde::Deserialize)]
pub struct CustomIdTokenClaims {
    auth_time: u64,
}

impl IdToken {
    pub fn to_jwt_claims(self) -> JWTClaims<CustomIdTokenClaims> {
        JWTClaims {
            issued_at: Some(Duration::from_secs(self.issued_at)),
            expires_at: Some(Duration::from_secs(self.expiration_time)),
            invalid_before: None,
            issuer: Some(self.issuer),
            subject: Some(self.subject_identifier),
            audiences: Some(Audiences::AsString(self.audience)),
            jwt_id: None,
            nonce: self.nonce,
            custom: CustomIdTokenClaims {
                auth_time: self.auth_time
            },
        }
    }
}