JWT & OAuth2

use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
 
#[derive(serde::Serialize, serde::Deserialize)]
struct Claims { sub: String, exp: usize, aud: String }
 
let token = encode(&Header::default(), &claims, &EncodingKey::from_secret(secret))?;
let data = decode::<Claims>(&token, &DecodingKey::from_secret(secret), &Validation::default())?;

use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
use oauth2::{AuthUrl, ClientId, ClientSecret, RedirectUrl, TokenUrl, basic::BasicClient};
 
#[derive(serde::Serialize, serde::Deserialize)]
struct AccessClaims {
    sub: String,
    exp: usize,
    aud: String,
}
 
fn issue_access_token(sub: &str, aud: &str, secret: &[u8], ttl_secs: usize) -> String {
    let exp = (std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_secs()
        + ttl_secs as u64) as usize;
    let claims = AccessClaims { sub: sub.into(), exp, aud: aud.into() };
    encode(&Header::default(), &claims, &EncodingKey::from_secret(secret)).unwrap()
}
 
fn validate_access_token(token: &str, secret: &[u8], expected_aud: &str) -> Result<AccessClaims, jsonwebtoken::errors::Error> {
    let mut validation = Validation::default();
    validation.set_audience(&[expected_aud]);
    let data = decode::<AccessClaims>(token, &DecodingKey::from_secret(secret), &validation)?;
    Ok(data.claims)
}
 
fn oauth_client() -> BasicClient {
    BasicClient::new(ClientId::new("client-id".into()))
        .set_client_secret(ClientSecret::new("client-secret".into()))
        .set_auth_uri(AuthUrl::new("https://issuer.example.com/oauth/authorize".into()).unwrap())
        .set_token_uri(TokenUrl::new("https://issuer.example.com/oauth/token".into()).unwrap())
        .set_redirect_uri(RedirectUrl::new("http://localhost:3000/callback".into()).unwrap())
}

// RS256 with public key from OIDC JWKS
let key = DecodingKey::from_rsa_pem(public_pem)?;