Struct OAuthDpopProof

pub struct OAuthDpopProof {
    pub jti_hash: Digest,
    pub seen_at: DateTime<Utc>,
    pub client_id: Option<String>,
    pub jkt: Option<String>,
    pub htm: Option<String>,
    pub htu: Option<String>,
    pub iat: Option<DateTime<Utc>>,
}

INTERNAL/DATABASE-ONLY MODEL - DO NOT EXPOSE TO CLIENTS

This struct is a database model that contains a Digest field, which contains raw bytes and uses custom (de)serialization. This model must never be serialized into external API payloads or returned directly to clients.

For external-facing responses, use DTOs such as TokenResponse, UserInfoResponse, or an explicit redacting wrapper that strips or converts Digest fields to safe types (e.g., strings).

Rationale: The Digest type contains sensitive raw bytes and uses custom serialization that is not suitable for external APIs. Exposing this model directly could leak internal implementation details or cause serialization issues.

Fields

jti_hash: Digest

seen_at: DateTime<Utc>

client_id: Option<String>

jkt: Option<String>

htm: Option<String>

htu: Option<String>

iat: Option<DateTime<Utc>>

Implementations

impl OAuthDpopProof

pub async fn insert_once( conn: &mut PgConnection, jti_hash: Digest, client_id: Option<&str>, jkt: Option<&str>, htm: Option<&str>, htu: Option<&str>, iat_epoch: Option<i64>, ) -> ModelResult<bool>

Atomically record this DPoP proof exactly once. Returns:

• Ok(true) => first time seen (ACCEPT)
• Ok(false) => already seen (REPLAY -> REJECT)

pub async fn find_by_jti_hash( conn: &mut PgConnection, jti_hash: Digest, ) -> ModelResult<Option<OAuthDpopProof>>

Fetch a stored proof row (for audits/debug).

pub async fn prune_older_than( conn: &mut PgConnection, keep_seconds: i64, ) -> ModelResult<u64>

Delete old entries (call from a periodic task). Returns number of rows removed.

Trait Implementations

impl Debug for OAuthDpopProof

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OAuthDpopProof

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<'a, R: Row> FromRow<'a, R> for OAuthDpopProof

where &'a str: ColumnIndex<R>, Digest: Decode<'a, R::Database> + Type<R::Database>, DateTime<Utc>: Decode<'a, R::Database> + Type<R::Database>, Option<String>: Decode<'a, R::Database> + Type<R::Database>, Option<DateTime<Utc>>: Decode<'a, R::Database> + Type<R::Database>,

fn from_row(__row: &'a R) -> Result<Self>

impl Serialize for OAuthDpopProof

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.