tuwunel_service/oauth/token_response.rs
1use serde::Deserialize;
2
3/// Fields deserialized from an upstream provider's `/token` response.
4///
5/// This separate shape omits `expires_at`: some providers encode it as a Unix
6/// timestamp, while the persisted `Session` stores a `SystemTime` derived from
7/// `expires_in`.
8#[derive(Debug, Deserialize)]
9pub struct TokenResponse {
10 /// Token type (bearer, mac, etc).
11 pub token_type: Option<String>,
12
13 /// Access token granted by the provider.
14 pub access_token: Option<String>,
15
16 /// Duration in seconds the access_token is valid for.
17 pub expires_in: Option<u64>,
18
19 /// Token used to refresh the access_token.
20 pub refresh_token: Option<String>,
21
22 /// Duration in seconds the refresh_token is valid for.
23 pub refresh_token_expires_in: Option<u64>,
24
25 /// Access scope actually granted (if supported).
26 pub scope: Option<String>,
27
28 /// Signed JWT containing the user's identity claims (OIDC).
29 pub id_token: Option<String>,
30}