MVP for client-side DPoP Header support

src/core/jwk.rs

@@ -20,7 +20,7 @@ use super::{crypto, CoreJwsSigningAlgorithm};
 ///
 /// Public or symmetric key expressed as a JSON Web Key.
 ///
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
 pub struct CoreJsonWebKey {
     pub(crate) kty: CoreJsonWebKeyType,
     #[serde(rename = "use", skip_serializing_if = "Option::is_none")]
@@ -544,7 +544,7 @@ impl
 ///
 /// Type of JSON Web Key.
 ///
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
 #[non_exhaustive]
 pub enum CoreJsonWebKeyType {
     ///
@@ -557,6 +557,7 @@ pub enum CoreJsonWebKeyType {
     ///
     /// RSA key.
     ///
+    #[default]
     #[serde(rename = "RSA")]
     RSA,
     ///

src/core/mod.rs

@@ -59,8 +59,8 @@ pub type CoreClient = Client<
     CoreJweContentEncryptionAlgorithm,
     CoreJwsSigningAlgorithm,
     CoreJsonWebKeyType,
-    CoreJsonWebKeyUse,
     CoreJsonWebKey,
+    CoreJsonWebKeyUse,
     CoreAuthPrompt,
     StandardErrorResponse<CoreErrorResponseType>,
     CoreTokenResponse,
@@ -136,6 +136,8 @@ pub type CoreIdToken = IdToken<
     CoreJweContentEncryptionAlgorithm,
     CoreJwsSigningAlgorithm,
     CoreJsonWebKeyType,
+    CoreJsonWebKey,
+    CoreJsonWebKeyUse
 >;
 
 ///
@@ -153,6 +155,8 @@ pub type CoreIdTokenFields = IdTokenFields<
     CoreJweContentEncryptionAlgorithm,
     CoreJwsSigningAlgorithm,
     CoreJsonWebKeyType,
+    CoreJsonWebKey,
+    CoreJsonWebKeyUse
 >;
 
 ///
@@ -212,6 +216,8 @@ pub type CoreUserInfoJsonWebToken = UserInfoJsonWebToken<
     CoreJweContentEncryptionAlgorithm,
     CoreJwsSigningAlgorithm,
     CoreJsonWebKeyType,
+    CoreJsonWebKey,
+    CoreJsonWebKeyUse
 >;
 
 ///

src/discovery.rs

@@ -43,7 +43,7 @@ impl AdditionalProviderMetadata for EmptyAdditionalProviderMetadata {}
 #[skip_serializing_none]
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
 #[allow(clippy::type_complexity)]
-pub struct ProviderMetadata<A, AD, CA, CN, CT, G, JE, JK, JS, JT, JU, K, RM, RT, S>
+pub struct ProviderMetadata<A, AD, CA, CN, CT, G, JE, JA, JS, JT, JU, JK, RM, RT, S>
 where
     A: AdditionalProviderMetadata,
     AD: AuthDisplay,
@@ -52,11 +52,11 @@ where
     CT: ClaimType,
     G: GrantType,
     JE: JweContentEncryptionAlgorithm<JT>,
-    JK: JweKeyManagementAlgorithm,
+    JA: JweKeyManagementAlgorithm,
     JS: JwsSigningAlgorithm<JT>,
     JT: JsonWebKeyType,
     JU: JsonWebKeyUse,
-    K: JsonWebKey<JS, JT, JU>,
+    JK: JsonWebKey<JS, JT, JU>,
     RM: ResponseMode,
     RT: ResponseType,
     S: SubjectIdentifierType,
@@ -67,7 +67,7 @@ where
     userinfo_endpoint: Option<UserInfoUrl>,
     jwks_uri: JsonWebKeySetUrl,
     #[serde(default = "JsonWebKeySet::default", skip)]
-    jwks: JsonWebKeySet<JS, JT, JU, K>,
+    jwks: JsonWebKeySet<JS, JT, JU, JK>,
     registration_endpoint: Option<RegistrationUrl>,
     scopes_supported: Option<Vec<Scope>>,
     #[serde(bound(deserialize = "RT: ResponseType"))]
@@ -83,11 +83,11 @@ where
     #[serde_as(as = "VecSkipError<_>")]
     id_token_signing_alg_values_supported: Vec<JS>,
     #[serde(
-        bound(deserialize = "JK: JweKeyManagementAlgorithm"),
+        bound(deserialize = "JA: JweKeyManagementAlgorithm"),
         default = "Option::default"
     )]
     #[serde_as(as = "Option<VecSkipError<_>>")]
-    id_token_encryption_alg_values_supported: Option<Vec<JK>>,
+    id_token_encryption_alg_values_supported: Option<Vec<JA>>,
     #[serde(
         bound(deserialize = "JE: JweContentEncryptionAlgorithm<JT>"),
         default = "Option::default"
@@ -101,11 +101,11 @@ where
     #[serde_as(as = "Option<VecSkipError<_>>")]
     userinfo_signing_alg_values_supported: Option<Vec<JS>>,
     #[serde(
-        bound(deserialize = "JK: JweKeyManagementAlgorithm"),
+        bound(deserialize = "JA: JweKeyManagementAlgorithm"),
         default = "Option::default"
     )]
     #[serde_as(as = "Option<VecSkipError<_>>")]
-    userinfo_encryption_alg_values_supported: Option<Vec<JK>>,
+    userinfo_encryption_alg_values_supported: Option<Vec<JA>>,
     #[serde(
         bound(deserialize = "JE: JweContentEncryptionAlgorithm<JT>"),
         default = "Option::default"
@@ -119,11 +119,11 @@ where
     #[serde_as(as = "Option<VecSkipError<_>>")]
     request_object_signing_alg_values_supported: Option<Vec<JS>>,
     #[serde(
-        bound(deserialize = "JK: JweKeyManagementAlgorithm"),
+        bound(deserialize = "JA: JweKeyManagementAlgorithm"),
         default = "Option::default"
     )]
     #[serde_as(as = "Option<VecSkipError<_>>")]
-    request_object_encryption_alg_values_supported: Option<Vec<JK>>,
+    request_object_encryption_alg_values_supported: Option<Vec<JA>>,
     #[serde(
         bound(deserialize = "JE: JweContentEncryptionAlgorithm<JT>"),
         default = "Option::default"
@@ -160,8 +160,8 @@ where
     #[serde(skip)]
     _phantom_jt: PhantomData<JT>,
 }
-impl<A, AD, CA, CN, CT, G, JE, JK, JS, JT, JU, K, RM, RT, S>
-    ProviderMetadata<A, AD, CA, CN, CT, G, JE, JK, JS, JT, JU, K, RM, RT, S>
+impl<A, AD, CA, CN, CT, G, JE, JA, JS, JT, JU, JK, RM, RT, S>
+    ProviderMetadata<A, AD, CA, CN, CT, G, JE, JA, JS, JT, JU, JK, RM, RT, S>
 where
     A: AdditionalProviderMetadata,
     AD: AuthDisplay,
@@ -170,11 +170,11 @@ where
     CT: ClaimType,
     G: GrantType,
     JE: JweContentEncryptionAlgorithm<JT>,
-    JK: JweKeyManagementAlgorithm,
+    JA: JweKeyManagementAlgorithm,
     JS: JwsSigningAlgorithm<JT>,
     JT: JsonWebKeyType,
     JU: JsonWebKeyUse,
-    K: JsonWebKey<JS, JT, JU>,
+    JK: JsonWebKey<JS, JT, JU>,
     RM: ResponseMode,
     RT: ResponseType,
     S: SubjectIdentifierType,
@@ -240,7 +240,7 @@ where
             set_token_endpoint -> token_endpoint[Option<TokenUrl>],
             set_userinfo_endpoint -> userinfo_endpoint[Option<UserInfoUrl>],
             set_jwks_uri -> jwks_uri[JsonWebKeySetUrl],
-            set_jwks -> jwks[JsonWebKeySet<JS, JT, JU, K>],
+            set_jwks -> jwks[JsonWebKeySet<JS, JT, JU, JK>],
             set_registration_endpoint -> registration_endpoint[Option<RegistrationUrl>],
             set_scopes_supported -> scopes_supported[Option<Vec<Scope>>],
             set_response_types_supported -> response_types_supported[Vec<ResponseTypes<RT>>],
@@ -252,19 +252,19 @@ where
             set_id_token_signing_alg_values_supported
                 -> id_token_signing_alg_values_supported[Vec<JS>],
             set_id_token_encryption_alg_values_supported
-                -> id_token_encryption_alg_values_supported[Option<Vec<JK>>],
+                -> id_token_encryption_alg_values_supported[Option<Vec<JA>>],
             set_id_token_encryption_enc_values_supported
                 -> id_token_encryption_enc_values_supported[Option<Vec<JE>>],
             set_userinfo_signing_alg_values_supported
                 -> userinfo_signing_alg_values_supported[Option<Vec<JS>>],
             set_userinfo_encryption_alg_values_supported
-                -> userinfo_encryption_alg_values_supported[Option<Vec<JK>>],
+                -> userinfo_encryption_alg_values_supported[Option<Vec<JA>>],
             set_userinfo_encryption_enc_values_supported
                 -> userinfo_encryption_enc_values_supported[Option<Vec<JE>>],
             set_request_object_signing_alg_values_supported
                 -> request_object_signing_alg_values_supported[Option<Vec<JS>>],
             set_request_object_encryption_alg_values_supported
-                -> request_object_encryption_alg_values_supported[Option<Vec<JK>>],
+                -> request_object_encryption_alg_values_supported[Option<Vec<JA>>],
             set_request_object_encryption_enc_values_supported
                 -> request_object_encryption_enc_values_supported[Option<Vec<JE>>],
             set_token_endpoint_auth_methods_supported

src/id_token.rs

@@ -37,32 +37,38 @@ pub struct IdToken<
     JE: JweContentEncryptionAlgorithm<JT>,
     JS: JwsSigningAlgorithm<JT>,
     JT: JsonWebKeyType,
+    JK: JsonWebKey<JS, JT, JU>,
+    JU: JsonWebKeyUse,
 >(
     #[serde(bound = "AC: AdditionalClaims")]
-    JsonWebToken<JE, JS, JT, IdTokenClaims<AC, GC>, JsonWebTokenJsonPayloadSerde>,
+    JsonWebToken<JE, JS, JT, JK, JU, IdTokenClaims<AC, GC>, JsonWebTokenJsonPayloadSerde>,
 );
 
-impl<AC, GC, JE, JS, JT> FromStr for IdToken<AC, GC, JE, JS, JT>
+impl<AC, GC, JE, JS, JT, JK, JU> FromStr for IdToken<AC, GC, JE, JS, JT, JK, JU>
 where
     AC: AdditionalClaims,
     GC: GenderClaim,
     JE: JweContentEncryptionAlgorithm<JT>,
     JS: JwsSigningAlgorithm<JT>,
     JT: JsonWebKeyType,
+    JK: JsonWebKey<JS, JT, JU>,
+    JU: JsonWebKeyUse,
 {
     type Err = serde_json::Error;
     fn from_str(s: &str) -> Result<Self, Self::Err> {
         serde_json::from_value(Value::String(s.to_string()))
     }
 }
 
-impl<AC, GC, JE, JS, JT> IdToken<AC, GC, JE, JS, JT>
+impl<AC, GC, JE, JS, JT, JK, JU> IdToken<AC, GC, JE, JS, JT, JK, JU>
 where
     AC: AdditionalClaims,
     GC: GenderClaim,
     JE: JweContentEncryptionAlgorithm<JT>,
     JS: JwsSigningAlgorithm<JT>,
     JT: JsonWebKeyType,
+    JK: JsonWebKey<JS, JT, JU>,
+    JU: JsonWebKeyUse,
 {
     ///
     /// Initializes an ID token with the specified claims, signed using the given signing key and
@@ -72,7 +78,7 @@ where
     /// `c_hash` claims using the given signing algorithm, respectively. Otherwise, those claims are
     /// unchanged from the values specified in `claims`.
     ///
-    pub fn new<JU, K, S>(
+    pub fn new<K, S>(
         claims: IdTokenClaims<AC, GC>,
         signing_key: &S,
         alg: JS,
@@ -112,14 +118,12 @@ where
     ///
     /// Verifies and returns a reference to the ID token claims.
     ///
-    pub fn claims<'a, JU, K, N>(
+    pub fn claims<'a, N>(
         &'a self,
-        verifier: &IdTokenVerifier<JS, JT, JU, K>,
+        verifier: &IdTokenVerifier<JS, JT, JU, JK>,
         nonce_verifier: N,
     ) -> Result<&'a IdTokenClaims<AC, GC>, ClaimsVerificationError>
     where
-        JU: JsonWebKeyUse,
-        K: JsonWebKey<JS, JT, JU>,
         N: NonceVerifier,
     {
         verifier.verified_claims(&self.0, nonce_verifier)
@@ -128,14 +132,12 @@ where
     ///
     /// Verifies and returns the ID token claims.
     ///
-    pub fn into_claims<JU, K, N>(
+    pub fn into_claims<N>(
         self,
-        verifier: &IdTokenVerifier<JS, JT, JU, K>,
+        verifier: &IdTokenVerifier<JS, JT, JU, JK>,
         nonce_verifier: N,
     ) -> Result<IdTokenClaims<AC, GC>, ClaimsVerificationError>
     where
-        JU: JsonWebKeyUse,
-        K: JsonWebKey<JS, JT, JU>,
         N: NonceVerifier,
     {
         verifier.verified_claims_owned(self.0, nonce_verifier)
@@ -162,13 +164,15 @@ where
         }
     }
 }
-impl<AC, GC, JE, JS, JT> ToString for IdToken<AC, GC, JE, JS, JT>
+impl<AC, GC, JE, JS, JT, JK, JU> ToString for IdToken<AC, GC, JE, JS, JT, JK, JU>
 where
     AC: AdditionalClaims,
     GC: GenderClaim,
     JE: JweContentEncryptionAlgorithm<JT>,
     JS: JwsSigningAlgorithm<JT>,
     JT: JsonWebKeyType,
+    JK: JsonWebKey<JS, JT, JU>,
+    JU: JsonWebKeyUse,
 {
     fn to_string(&self) -> String {
         serde_json::to_value(&self)
@@ -376,35 +380,39 @@ where
 /// Extends the base OAuth2 token response with an ID token.
 ///
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-pub struct IdTokenFields<AC, EF, GC, JE, JS, JT>
+pub struct IdTokenFields<AC, EF, GC, JE, JS, JT, JK, JU>
 where
     AC: AdditionalClaims,
     EF: ExtraTokenFields,
     GC: GenderClaim,
     JE: JweContentEncryptionAlgorithm<JT>,
     JS: JwsSigningAlgorithm<JT>,
     JT: JsonWebKeyType,
+    JK: JsonWebKey<JS, JT, JU>,
+    JU: JsonWebKeyUse,
 {
     #[serde(bound = "AC: AdditionalClaims")]
-    id_token: Option<IdToken<AC, GC, JE, JS, JT>>,
+    id_token: Option<IdToken<AC, GC, JE, JS, JT, JK, JU>>,
     #[serde(bound = "EF: ExtraTokenFields", flatten)]
     extra_fields: EF,
     #[serde(skip)]
     _phantom: PhantomData<JT>,
 }
-impl<AC, EF, GC, JE, JS, JT> IdTokenFields<AC, EF, GC, JE, JS, JT>
+impl<AC, EF, GC, JE, JS, JT, JK, JU> IdTokenFields<AC, EF, GC, JE, JS, JT, JK, JU>
 where
     AC: AdditionalClaims,
     EF: ExtraTokenFields,
     GC: GenderClaim,
     JE: JweContentEncryptionAlgorithm<JT>,
     JS: JwsSigningAlgorithm<JT>,
     JT: JsonWebKeyType,
+    JK: JsonWebKey<JS, JT, JU>,
+    JU: JsonWebKeyUse,
 {
     ///
     /// Initializes new ID token fields containing the specified [`IdToken`] and extra fields.
     ///
-    pub fn new(id_token: Option<IdToken<AC, GC, JE, JS, JT>>, extra_fields: EF) -> Self {
+    pub fn new(id_token: Option<IdToken<AC, GC, JE, JS, JT, JK, JU>>, extra_fields: EF) -> Self {
         Self {
             id_token,
             extra_fields,
@@ -415,7 +423,7 @@ where
     ///
     /// Returns the [`IdToken`] contained in the OAuth2 token response.
     ///
-    pub fn id_token(&self) -> Option<&IdToken<AC, GC, JE, JS, JT>> {
+    pub fn id_token(&self) -> Option<&IdToken<AC, GC, JE, JS, JT, JK, JU>> {
         self.id_token.as_ref()
     }
     ///
@@ -425,14 +433,16 @@ where
         &self.extra_fields
     }
 }
-impl<AC, EF, GC, JE, JS, JT> ExtraTokenFields for IdTokenFields<AC, EF, GC, JE, JS, JT>
+impl<AC, EF, GC, JE, JS, JT, JK, JU> ExtraTokenFields for IdTokenFields<AC, EF, GC, JE, JS, JT, JK, JU>
 where
     AC: AdditionalClaims,
     EF: ExtraTokenFields,
     GC: GenderClaim,
     JE: JweContentEncryptionAlgorithm<JT>,
     JS: JwsSigningAlgorithm<JT>,
     JT: JsonWebKeyType,
+    JK: JsonWebKey<JS, JT, JU>,
+    JU: JsonWebKeyUse,
 {
 }