Source: openagents/openagent.id/crates/openagent-server/src/session.rs. SHA-256: 9984fa2b50874326503665e883533b1999c40f51f154775fcd571f668069c348.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

session::SessionClaims

JWT claims for an OpenAgent session token.

Per OPENAGENT-CORE-SPEC.md §12:

• sub: the agent's DID (did:key or did:oas)
• iss: the server origin
• iat: issued-at timestamp (Unix seconds)
• exp: expiration timestamp (Unix seconds)
• nonce: the challenge nonce that was consumed
• trust_tier: the agent's trust tier (0-4)
• l1fe_id: the agent's L1feID platform UUID (None if L1feID was unreachable)
• lineage_authority: optional legacy lineage evidence retained for migration

#[derive(Debug, Serialize, Deserialize)]
pub struct SessionClaims {
pub sub: String,
pub iss: String,
pub iat: i64,
pub exp: i64,
pub nonce: String,
pub trust_tier: u8,
/// L1feID platform identifier.  Absent when the L1feID service was

/// unreachable during the initial provisioning call.

#[serde(skip_serializing_if = "Option::is_none")]
pub l1fe_id: Option<String>,
/// Legacy lineage evidence. Informational only; never forwarded as authority.

#[serde(skip_serializing_if = "Option::is_none")]
pub lineage_authority: Option<LegacyLineageEvidence>
}

Source line: 25.

session::issue_session_token

Issues a JWT session token.

Arguments

• did - The agent's DID
• origin - The server origin (becomes iss)
• nonce - The consumed challenge nonce
• trust_tier - The agent's trust tier
• l1fe_id - The agent's L1feID platform UUID (None if service unreachable)
• lineage_authority - Optional informational legacy lineage evidence
• ttl_secs - Token lifetime in seconds (default: 900 = 15 min)
• secret - HMAC-SHA256 signing secret

pub fn issue_session_token(
    did: &str,
    origin: &str,
    nonce: &str,
    trust_tier: u8,
    l1fe_id: Option<&str>,
    lineage_authority: Option<LegacyLineageEvidence>,
    ttl_secs: i64,
    secret: &[u8],
) -> Result<String, SessionError>;

Source line: 53.

session::validate_session_token

Validates a JWT session token and returns its claims.

pub fn validate_session_token(token: &str, secret: &[u8]) -> Result<SessionClaims, SessionError>;

Source line: 86.

session::SessionError

#[derive(Debug, thiserror::Error)]
pub enum SessionError {
    #[error("session token has expired")]
    Expired,

    #[error("session token signature is invalid")]
    InvalidSignature,

    #[error("failed to encode session token: {0}")]
    EncodingFailed(String),

    #[error("session token validation failed: {0}")]
    ValidationFailed(String),
}

Source line: 102.