Skip to main content

tuwunel_service/oauth/server/
jwk.rs

1use aws_lc_rs::signature::{self, EcdsaKeyPair, KeyPair};
2use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD as b64};
3use serde_json::{Value as JsonValue, json};
4use tuwunel_core::{Result, err};
5
6impl super::Server {
7	#[inline]
8	#[must_use]
9	pub fn jwks(&self) -> JsonValue {
10		json!({
11			"keys": [self.jwk.clone()],
12		})
13	}
14}
15
16pub(super) fn init_jwk(key_der: &[u8], key_id: &str) -> Result<JsonValue> {
17	let alg = &signature::ECDSA_P256_SHA256_FIXED_SIGNING;
18	let key_pair = EcdsaKeyPair::from_pkcs8(alg, key_der)
19		.map_err(|e| err!(error!("Failed to load ECDSA key: {e}")))?;
20
21	let public_bytes = key_pair.public_key().as_ref();
22
23	Ok(json!({
24		"kty": "EC",
25		"crv": "P-256",
26		"use": "sig",
27		"alg": "ES256",
28		"kid": key_id,
29		"x": b64.encode(&public_bytes[1..33]),
30		"y": b64.encode(&public_bytes[33..65]),
31	}))
32}