Method validate_bearer

crates/openshell-server/src/auth/sandbox_jwt.rs:166–201

(&self, token: &str)

    #[allow(clippy::result_large_err)]
    fn validate_bearer(&self, token: &str) -> Result<Option<Principal>, Status> {
        let header = decode_header(token).map_err(|e| {
            debug!(error = %e, "sandbox JWT header decode failed");
            Status::unauthenticated("invalid token")
        })?;

        // Fall through to other authenticators when the kid does not match —
        // OIDC issuers may share the Bearer slot.
        if header.kid.as_deref() != Some(self.kid.as_str()) {
            return Ok(None);
        }
        if !matches!(header.alg, Algorithm::EdDSA) {
            return Ok(None);
        }

        let mut validation = Validation::new(Algorithm::EdDSA);
        validation.algorithms = vec![Algorithm::EdDSA];
        validation.set_issuer(&[&self.issuer]);
        validation.set_audience(&[&self.audience]);
        validation.set_required_spec_claims(&["iss", "aud", "exp", "sub"]);
        validation.validate_exp = false;

        let data =
            decode::<SandboxJwtClaims>(token, &self.decoding_key, &validation).map_err(|e| {
                debug!(error = %e, "sandbox JWT validation failed");
                Status::unauthenticated(format!("invalid token: {e}"))
            })?;

        let claims = data.claims;
        validate_exp(claims.exp)?;
        Ok(Some(Principal::Sandbox(SandboxPrincipal {
            sandbox_id: claims.sandbox_id,
            source: SandboxIdentitySource::BootstrapJwt { issuer: claims.iss },
            trust_domain: Some("openshell".to_string()),
        })))
    }
}

#[async_trait]