patch tags

backend/src/auth/jwt.rs

@@ -13,6 +13,8 @@ pub struct JwtService {
     issuer: String,
     audience: String,
     expiry: Duration,
+    download_audience: String,
+    download_expiry: Duration,
 }
 
 impl JwtService {
@@ -23,6 +25,8 @@ impl JwtService {
             issuer: config.jwt_issuer.clone(),
             audience: config.jwt_audience.clone(),
             expiry: Duration::minutes(config.jwt_expiry_minutes),
+            download_audience: config.download_token_audience.clone(),
+            download_expiry: Duration::minutes(config.download_token_expiry_minutes),
         })
     }
 
@@ -49,6 +53,29 @@ impl JwtService {
         let data = decode::<Claims>(token, &self.decoding, &validation)?;
         Ok(data.claims)
     }
+
+    pub fn generate_download_token(&self, document_id: Uuid, user_id: Uuid) -> Result<String> {
+        let now = Utc::now();
+        let exp = now + self.download_expiry;
+        let claims = DownloadClaims {
+            doc_id: document_id,
+            user_id,
+            iss: self.issuer.clone(),
+            aud: self.download_audience.clone(),
+            iat: now.timestamp() as usize,
+            exp: exp.timestamp() as usize,
+        };
+
+        Ok(encode(&Header::default(), &claims, &self.encoding)?)
+    }
+
+    pub fn verify_download_token(&self, token: &str) -> Result<DownloadClaims> {
+        let mut validation = Validation::default();
+        validation.set_audience(&[self.download_audience.clone()]);
+        validation.set_issuer(&[self.issuer.clone()]);
+        let data = decode::<DownloadClaims>(token, &self.decoding, &validation)?;
+        Ok(data.claims)
+    }
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -61,3 +88,13 @@ pub struct Claims {
     pub iat: usize,
     pub exp: usize,
 }
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DownloadClaims {
+    pub doc_id: Uuid,
+    pub user_id: Uuid,
+    pub iss: String,
+    pub aud: String,
+    pub iat: usize,
+    pub exp: usize,
+}