openagent-oidc · jwt
Declared module signatures, types, configuration, and source documentation.
Source: openagent-sdk/bridges/oidc/rust/src/jwt.rs. SHA-256: 3a1b313c20181eae9860c5525d156a1748a6859d586b20e6b1b6769905f36aab.
This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.
jwt::ValidatedClaims
Standard + custom claims extracted from a validated human JWT.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ValidatedClaims {
/// Issuer (`iss` claim).
pub issuer: String,
/// Subject (`sub` claim) — typically the human user's unique ID.
pub subject: String,
/// Audience (`aud` claim), if present.
#[serde(default)]
pub audience: Vec<String>,
/// Expiration time (epoch seconds).
pub exp: i64,
/// Issued-at time (epoch seconds).
#[serde(default)]
pub iat: i64,
/// The claim value that maps to the HMR (configurable, default `sub`).
pub hmr_value: String,
/// OIDC scopes or roles extracted from the token.
#[serde(default)]
pub scopes: Vec<String>,
/// All original claims (for custom mapping).
#[serde(default)]
pub raw_claims: HashMap<String, serde_json::Value>
}Source line: 23.
jwt::decode_jwt_header
Decode the JWT header without validation (to extract kid and alg).
Errors
Returns [OidcBridgeError::JwtValidation] if the header is malformed.
pub fn decode_jwt_header(token: &str) -> Result<Header>;Source line: 81.
jwt::validate_jwt
Validate and decode a JWT using the given decoding key.
Performs standard OIDC validation: issuer match, audience match (if configured), expiry check, signature verification.
Errors
Returns [OidcBridgeError::JwtValidation] on any validation failure.
pub fn validate_jwt(
token: &str,
key: &DecodingKey,
algorithm: Algorithm,
provider: &ProviderConfig,
) -> Result<ValidatedClaims>;Source line: 95.
jwt::ActJwtClaims
Claims for an outbound JWT that wraps an Arsenal ACT (Flow 2).
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ActJwtClaims {
/// Subject: the agent's DID.
pub sub: String,
/// Issuer: the bridge's own issuer identifier.
pub iss: String,
/// Audience: the service that will consume this JWT.
#[serde(skip_serializing_if = "Option::is_none")]
pub aud: Option<String>,
/// Expiration (epoch seconds).
pub exp: i64,
/// Issued-at (epoch seconds).
pub iat: i64,
/// JWT ID for replay prevention.
pub jti: String,
/// Arsenal scope strings mapped from the ACT.
pub scope: String,
/// The agent's lineage depth (hops from HMR root).
pub lineage_depth: u32,
/// The parent HMR DID.
pub parent_hmr: String,
/// The serialized ACT (base64url-encoded).
pub act: String
}Source line: 156.
jwt::sign_act_jwt
Sign a JWT wrapping an Arsenal ACT for services that speak OAuth2.
The resulting JWT can be introspected by standard OAuth2 resource servers.
Custom claims (lineage_depth, parent_hmr, act) carry the agent
identity metadata.
Arguments
claims- Pre-built ACT JWT claims.signing_key- Ed25519 or RSA private key in PEM or DER format.algorithm- The signing algorithm (e.g.,EdDSA,RS256).kid- Optional key ID to include in the JWT header.
Errors
Returns [OidcBridgeError::Signing] if encoding fails.
pub fn sign_act_jwt(
claims: &ActJwtClaims,
signing_key: &EncodingKey,
algorithm: Algorithm,
kid: Option<&str>,
) -> Result<String>;Source line: 196.
jwt::build_act_claims
Build ACT JWT claims from the parts produced by the bridge.
pub fn build_act_claims(
agent_did: &str,
bridge_issuer: &str,
audience: Option<&str>,
scopes: &[String],
lineage_depth: u32,
parent_hmr: &str,
act_b64: &str,
ttl_seconds: i64,
) -> ActJwtClaims;Source line: 212.