use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize, de, ser};
use std::fmt;
use std::str::FromStr;
use tranquil_types::{Did, Jti, Nsid};
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum TokenType {
Access,
Refresh,
Service,
}
impl TokenType {
pub fn as_str(&self) -> &'static str {
match self {
Self::Access => "at+jwt",
Self::Refresh => "refresh+jwt",
// RFC 7519 §5.1 recommends the uppercase "JWT".
// and for atproto inter-service auth its a requirement.
Self::Service => "JWT",
}
}
}
impl fmt::Display for TokenType {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
f.write_str(self.as_str())
}
}
impl FromStr for TokenType {
type Err = TokenTypeParseError;
fn from_str(s: &str) -> Result<Self, Self::Err> {
match s.to_ascii_lowercase().as_str() {
"at+jwt" => Ok(Self::Access),
"refresh+jwt" => Ok(Self::Refresh),
"jwt" => Ok(Self::Service),
_ => Err(TokenTypeParseError(s.to_string())),
}
}
}
#[derive(Debug, Clone)]
pub struct TokenTypeParseError(pub String);
impl fmt::Display for TokenTypeParseError {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
write!(f, "unknown token type: {}", self.0)
}
}
impl std::error::Error for TokenTypeParseError {}
impl Serialize for TokenType {
fn serialize<S: ser::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
serializer.serialize_str(self.as_str())
}
}
impl<'de> Deserialize<'de> for TokenType {
fn deserialize<D: de::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
let s = String::deserialize(deserializer)?;
Self::from_str(&s).map_err(de::Error::custom)
}
}
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum SigningAlgorithm {
ES256K,
HS256,
}
impl SigningAlgorithm {
pub fn as_str(&self) -> &'static str {
match self {
Self::ES256K => "ES256K",
Self::HS256 => "HS256",
}
}
}
impl fmt::Display for SigningAlgorithm {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
f.write_str(self.as_str())
}
}
impl FromStr for SigningAlgorithm {
type Err = SigningAlgorithmParseError;
fn from_str(s: &str) -> Result<Self, Self::Err> {
match s.to_ascii_uppercase().as_str() {
"ES256K" => Ok(Self::ES256K),
"HS256" => Ok(Self::HS256),
_ => Err(SigningAlgorithmParseError(s.to_string())),
}
}
}
#[derive(Debug, Clone)]
pub struct SigningAlgorithmParseError(pub String);
impl fmt::Display for SigningAlgorithmParseError {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
write!(f, "unknown signing algorithm: {}", self.0)
}
}
impl std::error::Error for SigningAlgorithmParseError {}
impl Serialize for SigningAlgorithm {
fn serialize<S: ser::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
serializer.serialize_str(self.as_str())
}
}
impl<'de> Deserialize<'de> for SigningAlgorithm {
fn deserialize<D: de::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
let s = String::deserialize(deserializer)?;
Self::from_str(&s).map_err(de::Error::custom)
}
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum TokenScope {
Access,
Refresh,
AppPass,
AppPassPrivileged,
Custom(String),
}
impl TokenScope {
pub fn as_str(&self) -> &str {
match self {
Self::Access => "com.atproto.access",
Self::Refresh => "com.atproto.refresh",
Self::AppPass => "com.atproto.appPass",
Self::AppPassPrivileged => "com.atproto.appPassPrivileged",
Self::Custom(s) => s,
}
}
pub fn is_access_like(&self) -> bool {
matches!(self, Self::Access | Self::AppPass | Self::AppPassPrivileged)
}
}
impl fmt::Display for TokenScope {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
f.write_str(self.as_str())
}
}
impl FromStr for TokenScope {
type Err = std::convert::Infallible;
fn from_str(s: &str) -> Result<Self, Self::Err> {
Ok(match s {
"com.atproto.access" => Self::Access,
"com.atproto.refresh" => Self::Refresh,
"com.atproto.appPass" => Self::AppPass,
"com.atproto.appPassPrivileged" => Self::AppPassPrivileged,
other => Self::Custom(other.to_string()),
})
}
}
impl Serialize for TokenScope {
fn serialize<S: ser::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
serializer.serialize_str(self.as_str())
}
}
impl<'de> Deserialize<'de> for TokenScope {
fn deserialize<D: de::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
let s = String::deserialize(deserializer)?;
Ok(Self::from_str(&s).unwrap_or_else(|e| match e {}))
}
}
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum TokenDecodeError {
InvalidFormat,
Base64DecodeFailed,
JsonDecodeFailed,
MissingClaim,
}
impl fmt::Display for TokenDecodeError {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
match self {
Self::InvalidFormat => write!(f, "Invalid token format"),
Self::Base64DecodeFailed => write!(f, "Base64 decode failed"),
Self::JsonDecodeFailed => write!(f, "JSON decode failed"),
Self::MissingClaim => write!(f, "Missing required claim"),
}
}
}
impl std::error::Error for TokenDecodeError {}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ActClaim {
pub sub: Did,
}
#[derive(Debug, Serialize, Deserialize)]
pub struct Claims {
pub iss: Did,
pub sub: Did,
pub aud: String,
pub exp: i64,
pub iat: i64,
#[serde(skip_serializing_if = "Option::is_none")]
pub scope: Option<String>,
#[serde(skip_serializing_if = "Option::is_none")]
pub lxm: Option<Nsid>,
pub jti: Jti,
#[serde(skip_serializing_if = "Option::is_none")]
pub act: Option<ActClaim>,
}
#[derive(Debug, Serialize, Deserialize)]
pub struct Header {
pub alg: SigningAlgorithm,
pub typ: TokenType,
}
#[derive(Debug, Serialize, Deserialize)]
pub struct UnsafeClaims {
pub iss: Did,
pub sub: Option<Did>,
}
pub struct TokenData<T> {
pub claims: T,
}
pub struct TokenWithMetadata {
pub token: String,
pub jti: Jti,
pub expires_at: DateTime<Utc>,
}
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum TokenVerifyError {
Expired,
Invalid(&'static str),
}
impl fmt::Display for TokenVerifyError {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
match self {
Self::Expired => write!(f, "Token expired"),
Self::Invalid(reason) => write!(f, "{}", reason),
}
}
}
impl std::error::Error for TokenVerifyError {}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn token_type_accepts_bluesky_uppercase_jwt() {
let result: Result<Header, _> = serde_json::from_str(r#"{"alg":"ES256K","typ":"JWT"}"#);
let header = result.expect("should parse uppercase JWT from bluesky reference pds");
assert_eq!(header.typ, TokenType::Service);
assert_eq!(header.alg, SigningAlgorithm::ES256K);
}
#[test]
fn token_type_accepts_lowercase_jwt() {
let result: Result<Header, _> = serde_json::from_str(r#"{"alg":"ES256K","typ":"jwt"}"#);
let header = result.expect("should parse lowercase jwt");
assert_eq!(header.typ, TokenType::Service);
}
#[test]
fn token_type_accepts_mixed_case_access() {
assert_eq!(TokenType::from_str("AT+JWT").unwrap(), TokenType::Access);
assert_eq!(TokenType::from_str("at+jwt").unwrap(), TokenType::Access);
assert_eq!(TokenType::from_str("At+Jwt").unwrap(), TokenType::Access);
}
#[test]
fn token_type_rejects_unknown() {
assert!(TokenType::from_str("bearer").is_err());
}
#[test]
fn service_token_header_serializes_typ_as_uppercase_jwt() {
// RFC 7519 §5.1 recommends the JWT `typ` header value be uppercase "JWT".
let header = Header {
alg: SigningAlgorithm::ES256K,
typ: TokenType::Service,
};
let json = serde_json::to_string(&header).expect("serialize header");
assert!(json.contains(r#""typ":"JWT""#), "got {json}");
}
#[test]
fn signing_algorithm_case_insensitive() {
assert_eq!(
SigningAlgorithm::from_str("ES256K").unwrap(),
SigningAlgorithm::ES256K
);
assert_eq!(
SigningAlgorithm::from_str("es256k").unwrap(),
SigningAlgorithm::ES256K
);
assert_eq!(
SigningAlgorithm::from_str("hs256").unwrap(),
SigningAlgorithm::HS256
);
}
}