tuwunel_service/oauth/server/
jwk.rs1use aws_lc_rs::signature::{self, EcdsaKeyPair, KeyPair};
2use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD as b64};
3use serde_json::{Value as JsonValue, json};
4use tuwunel_core::{Result, err};
5
6impl super::Server {
7 #[inline]
8 #[must_use]
9 pub fn jwks(&self) -> JsonValue {
10 json!({
11 "keys": [self.jwk.clone()],
12 })
13 }
14}
15
16pub(super) fn init_jwk(key_der: &[u8], key_id: &str) -> Result<JsonValue> {
17 let alg = &signature::ECDSA_P256_SHA256_FIXED_SIGNING;
18 let key_pair = EcdsaKeyPair::from_pkcs8(alg, key_der)
19 .map_err(|e| err!(error!("Failed to load ECDSA key: {e}")))?;
20
21 let public_bytes = key_pair.public_key().as_ref();
22
23 Ok(json!({
24 "kty": "EC",
25 "crv": "P-256",
26 "use": "sig",
27 "alg": "ES256",
28 "kid": key_id,
29 "x": b64.encode(&public_bytes[1..33]),
30 "y": b64.encode(&public_bytes[33..65]),
31 }))
32}