Struct OperatorAuth 

pub struct OperatorAuth {
    operator_did: String,
    session_ttl: Duration,
    client: OAuthClient<Resolver, MemoryAuthStore>,
    sessions: Mutex<HashMap<String, Session>>,
    pending: Mutex<HashMap<String, (Option<String>, Instant)>>,
}

The operator sign-in for one deployment.

Fields

operator_did: String

session_ttl: Duration

client: OAuthClient<Resolver, MemoryAuthStore>

sessions: Mutex<HashMap<String, Session>>

pending: Mutex<HashMap<String, (Option<String>, Instant)>>

Sign-ins started but not yet come back, keyed by the state this server chose. The value is where to send the browser afterwards — None for the dashboard’s own flow, and a loopback URL for a CLI waiting on one. See Self::start.

Implementations

impl OperatorAuth

pub fn new( operator_did: impl Into<String>, base_url: &str, session_ttl: Duration, ) -> Result<Arc<Self>, String>

Builds the sign-in for operator_did, publishing client metadata at base_url + CLIENT_METADATA_PATH.

base_url is this deployment’s own public origin, with no trailing slash — the authorization server fetches the metadata document from it and checks the redirect against it, so it has to be the address a browser actually reached.

pub fn operator_did(&self) -> &str

The DID this deployment will accept a sign-in from, and nobody else.

pub fn session_ttl(&self) -> Duration

How long a session this issues stays good for.

pub fn client_metadata_document(&self) -> Result<Value, String>

The client metadata document, as the JSON served at CLIENT_METADATA_PATH.

pub async fn start( &self, cli_redirect: Option<&str>, ) -> Result<String, SignInError>

Resolves this deployment’s operator and returns the URL to send the browser to.

The identity is the one --operator names and no other, so no caller picks the host this server resolves and pushes an authorization request to. What is checked at the far end is still the sub that comes back.

cli_redirect is where to send the browser once the sign-in lands, for a command-line caller waiting on a loopback address. It is refused unless it is loopback: this server would otherwise bounce a browser anywhere a link asked it to, carrying a freshly minted operator session.

pub async fn finish( &self, params: CallbackParams, ) -> Result<SignedIn, SignInError>

Completes the redirect and, if it authenticated the operator, mints a session. Returns the session token and its CSRF token.

The OAuth session itself is dropped here: this server wanted the sub and has it.

pub(crate) fn mint(&self) -> SignedIn

Issues a session for a caller already established as the operator.

pub(crate) and no wider: this is the one call that hands out an operator session without authenticating anybody, so the only callers are Self::finish, which has just checked the sub, and tests: the dashboard’s own, and Self::mint_for_tests’s.

pub fn mint_for_tests(&self) -> SignedIn

A session as if the operator had just signed in, for a test standing a server up with no authorization server to sign in through.

pub fn lookup(&self, token: &str) -> Option<String>

Whether token is a live session, and if so what CSRF token it expects. A read may stop here; see Self::authorize.

pub fn authorize(&self, token: &str, presented_csrf: Option<&str>) -> bool

Whether token may perform a mutating operator action.

A cookie is sent by the browser on a request another origin caused, so a live session is necessary and not sufficient: a request that changes something must also echo the session’s own CSRF token, which only a page served from this origin can have read.

pub fn sign_out(&self, token: &str)

Ends one session.