Source: openagent-sdk/bridges/oidc/rust/src/bridge.rs. SHA-256: db0ca0778211c56f2305ad437135aa8f90f539d82d69641a68f053e2fd1b3e6d.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

bridge::OidcBridge

The OIDC bridge — maps between human OIDC tokens and OAS agent identities.

Thread-safe and cheaply cloneable (all internal state is behind Arc).

Example

let bridge = OidcBridge::new(OidcConfig::single(
    ProviderConfig::new("okta", "https://dev-123.okta.com/oauth2/default")
        .with_audience("my-app"),
))?;

// Flow 1: Human JWT -> Agent DID
let agent = bridge.derive_agent_from_jwt(&jwt_string, "my-bot").await?;

// Flow 2: Agent ACT -> JWT
let jwt = bridge.act_to_jwt(&act_claims, &signing_key, Algorithm::EdDSA, None).await?;

#[derive(Debug, Clone)]
pub struct OidcBridge {

}

Source line: 45.

bridge::OidcBridge::new

Create a new OIDC bridge with the given configuration.

Errors

Returns [OidcBridgeError::Config] if the configuration is invalid.

pub fn new(config: OidcConfig) -> Result<Self>;

Source line: 57.

bridge::OidcBridge::config

Access the bridge configuration.

pub fn config(&self) -> &OidcConfig;

Source line: 71.

bridge::OidcBridge::derive_agent_from_jwt

Derive an agent DID from a human's OIDC JWT.

1. Decodes the JWT header to find the algorithm and key ID.
2. Identifies the OIDC provider from the iss claim.
3. Fetches the provider's JWKS (cached, with rotation-aware refresh).
4. Validates the JWT (signature, issuer, audience, expiry).
5. Maps the JWT subject to an HMR DID.
6. Derives a child agent DID under that HMR.

Errors

Returns errors from any step in the chain (discovery, JWKS, validation, identity derivation).

pub async fn derive_agent_from_jwt(
        &self,
        token: &str,
        agent_name: &str,
    ) -> Result<DerivedAgent>;

Source line: 90.

bridge::OidcBridge::act_to_jwt

Wrap an Arsenal ACT into a standard JWT for services that speak OAuth2.

The resulting JWT includes custom claims (lineage_depth, parent_hmr, act) alongside standard OAuth2 claims (sub, iss, aud, scope, exp).

Arguments

• claims - Pre-built ACT JWT claims (use [build_act_claims]).
• signing_key - The key to sign the JWT with.
• algorithm - Signing algorithm (e.g., EdDSA, RS256).
• kid - Optional key ID for the JWT header.

Errors

Returns [OidcBridgeError::Signing] if JWT encoding fails.

pub fn act_to_jwt(
        &self,
        claims: &ActJwtClaims,
        signing_key: &EncodingKey,
        algorithm: Algorithm,
        kid: Option<&str>,
    ) -> Result<String>;

Source line: 145.

bridge::OidcBridge::wrap_act_as_jwt

Convenience: build ACT claims and sign in one step.

pub fn wrap_act_as_jwt(
        &self,
        agent_did: &str,
        bridge_issuer: &str,
        audience: Option<&str>,
        scopes: &[String],
        lineage_depth: u32,
        parent_hmr: &str,
        act_b64: &str,
        signing_key: &EncodingKey,
        algorithm: Algorithm,
        kid: Option<&str>,
    ) -> Result<String>;

Source line: 156.

bridge::OidcBridge::exchange_token

Execute an RFC 8693 token exchange.

Validates the subject token (human JWT), derives an agent, and returns an ACT-wrapped JWT as the exchanged token.

Arguments

• request - The token exchange request.
• signing_key - Key for signing the response JWT.
• algorithm - Signing algorithm.
• bridge_issuer - Issuer claim for the response JWT.

Errors

Returns errors from request validation, JWT validation, or signing.

pub async fn exchange_token(
        &self,
        request: &TokenExchangeRequest,
        signing_key: &EncodingKey,
        algorithm: Algorithm,
        bridge_issuer: &str,
    ) -> Result<TokenExchangeResponse>;

Source line: 199.

bridge::OidcBridge::exchange_token_simple

Convenience: exchange a human JWT for agent scopes in one call.

Combines Flow 1 and scope mapping without requiring the caller to construct a full [TokenExchangeRequest].

pub async fn exchange_token_simple(
        &self,
        human_jwt: &str,
        requested_scopes: &[&str],
        signing_key: &EncodingKey,
        algorithm: Algorithm,
        bridge_issuer: &str,
    ) -> Result<TokenExchangeResponse>;

Source line: 259.

bridge::OidcBridge::validate_jwt

Validate a JWT and return its claims without deriving an agent.

Useful when you only need to verify the human's identity, not spawn an agent.

pub async fn validate_jwt(&self, token: &str) -> Result<ValidatedClaims>;

Source line: 278.

bridge::OidcBridge::refresh_all_jwks

Force-refresh the JWKS cache for all configured providers.

pub async fn refresh_all_jwks(&self);

Source line: 300.