Struct OAuthAccessToken

pub struct OAuthAccessToken {
    pub digest: Digest,
    pub user_id: Option<Uuid>,
    pub client_id: Uuid,
    pub scopes: Vec<String>,
    pub audience: Option<Vec<String>>,
    pub jti: Uuid,
    pub dpop_jkt: Option<String>,
    pub token_type: TokenType,
    pub metadata: Value,
    pub expires_at: DateTime<Utc>,
    pub created_at: DateTime<Utc>,
}

INTERNAL/DATABASE-ONLY MODEL - DO NOT EXPOSE TO CLIENTS

This struct is a database model that contains a Digest field, which contains raw bytes and uses custom (de)serialization. This model must never be serialized into external API payloads or returned directly to clients.

For external-facing responses, use DTOs such as TokenResponse, UserInfoResponse, or an explicit redacting wrapper that strips or converts Digest fields to safe types (e.g., strings).

Rationale: The Digest type contains sensitive raw bytes and uses custom serialization that is not suitable for external APIs. Exposing this model directly could leak internal implementation details or cause serialization issues.

Fields

digest: Digest

user_id: Option<Uuid>

client_id: Uuid

scopes: Vec<String>

audience: Option<Vec<String>>

jti: Uuid

dpop_jkt: Option<String>

Sender constraint: present only when token_type = DPoP

token_type: TokenType

metadata: Value

expires_at: DateTime<Utc>

created_at: DateTime<Utc>

Implementations

impl OAuthAccessToken

pub async fn insert( conn: &mut PgConnection, params: NewAccessTokenParams<'_>, ) -> ModelResult<()>

Insert a new access token (with jti).

DB constraint requires:

• Bearer => dpop_jkt = NULL
• DPoP => dpop_jkt IS NOT NULL

pub async fn find_valid( conn: &mut PgConnection, digest: Digest, ) -> ModelResult<OAuthAccessToken>

Find a still-valid token by digest (no sender enforcement).

pub async fn find_valid_for_sender( conn: &mut PgConnection, digest: Digest, sender_jkt: Option<&str>, ) -> ModelResult<OAuthAccessToken>

Find a still-valid token by digest and enforce sender:

• DPoP => dpop_jkt must match sender_jkt
• Bearer => sender is ignored

pub async fn delete_all_by_user_client( conn: &mut PgConnection, user_id: Uuid, client_id: Uuid, ) -> ModelResult<()>

pub async fn revoke_by_digest( conn: &mut PgConnection, digest: Digest, ) -> ModelResult<()>

Revoke (delete) an access token by its digest.

This method is used for the OAuth 2.0 token revocation endpoint (RFC 7009). Access tokens are deleted rather than marked as revoked since they are short-lived.

Trait Implementations

impl Debug for OAuthAccessToken

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OAuthAccessToken

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<'a, R: Row> FromRow<'a, R> for OAuthAccessToken

where &'a str: ColumnIndex<R>, Digest: Decode<'a, R::Database> + Type<R::Database>, Option<Uuid>: Decode<'a, R::Database> + Type<R::Database>, Uuid: Decode<'a, R::Database> + Type<R::Database>, Vec<String>: Decode<'a, R::Database> + Type<R::Database>, Option<Vec<String>>: Decode<'a, R::Database> + Type<R::Database>, Option<String>: Decode<'a, R::Database> + Type<R::Database>, TokenType: Decode<'a, R::Database> + Type<R::Database>, Value: Decode<'a, R::Database> + Type<R::Database>, DateTime<Utc>: Decode<'a, R::Database> + Type<R::Database>,

fn from_row(__row: &'a R) -> Result<Self>

impl Serialize for OAuthAccessToken

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.