caps and delete

backend/src/auth/jwt.rs

@@ -6,6 +6,24 @@ use uuid::Uuid;
 
 use crate::config::AppConfig;
 
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum PrincipalKind {
+    UserSession,
+    ApiToken,
+}
+
+#[derive(Debug, Clone)]
+pub struct AccessTokenContext {
+    pub user_id: Uuid,
+    pub tenant_id: Uuid,
+    pub username: String,
+    pub principal_kind: PrincipalKind,
+    pub principal_id: Uuid,
+    pub capability_set_id: Uuid,
+    pub cap_version: i32,
+}
+
 #[derive(Clone)]
 pub struct JwtService {
     encoding: EncodingKey,
@@ -38,13 +56,17 @@ impl JwtService {
         })
     }
 
-    pub fn generate_token(&self, user_id: Uuid, tenant_id: Uuid, username: &str) -> Result<String> {
+    pub fn generate_token(&self, context: AccessTokenContext) -> Result<String> {
         let now = Utc::now();
         let exp = now + self.expiry;
         let claims = Claims {
-            sub: user_id,
-            tenant_id,
-            username: username.to_owned(),
+            sub: context.user_id,
+            tenant_id: context.tenant_id,
+            username: context.username,
+            principal_kind: context.principal_kind,
+            principal_id: context.principal_id,
+            capability_set_id: context.capability_set_id,
+            cap_version: context.cap_version,
             iss: self.issuer.clone(),
             aud: self.audience.clone(),
             iat: now.timestamp() as usize,
@@ -148,6 +170,10 @@ pub struct Claims {
     pub sub: Uuid,
     pub tenant_id: Uuid,
     pub username: String,
+    pub principal_kind: PrincipalKind,
+    pub principal_id: Uuid,
+    pub capability_set_id: Uuid,
+    pub cap_version: i32,
     pub iss: String,
     pub aud: String,
     pub iat: usize,