Module exchange 

RFC 8693 token exchange: exchange an inbound NHI token for a backend-scoped token with narrowed scopes.

The exchange endpoint accepts a form-encoded request containing:

• grant_type=urn:ietf:params:oauth:grant-type:token-exchange
• subject_token — the inbound NHI JWT
• subject_token_type=urn:ietf:params:oauth:token-type:jwt
• audience — the target backend name
• scope — requested scopes (space-separated, optional)
• actor_token / actor_token_type — optional RFC 8693 §2.1 actor: a validated NHI token naming the agent that will act

The issued token preserves the original sub (human principal) and records the acting agents in act, newest first. Without an actor token, act.sub and azp are the subject token’s agent. With an actor token, act.sub and azp are the actor’s agent and the subject’s agent moves one level down (act.act.sub). Scopes are always an intersection, never a union: requested ∩ subject, and additionally ∩ actor when an actor token is present.

Structs

ExchangeActor

A validated RFC 8693 actor token.

ExchangeParams

Parameters for building exchanged claims.

ExchangedClaims

Signed ancestry travels with exchanged tokens without trusting such claims in upstream NHI tokens. Each entry came from a verified delegation link.

ExchangedValidation

Trust and time settings for a token issued by this harness.

TokenExchangeRequest

Token exchange request (form-encoded body).

TokenExchangeResponse

Token exchange response.

Enums

ExchangeError

Errors from the exchange process.

Constants

JWT_TOKEN_TYPE

RFC 8693 JWT token type.

TOKEN_EXCHANGE_GRANT_TYPE

RFC 8693 grant type.

Functions

build_exchanged_claims

Build exchanged claims from a validated subject token. The resulting token preserves sub (the human), adds a new link to the act chain, scopes to the intersection of requested and subject scopes, and narrows audience to the target backend.

build_exchanged_claims_with_actor

build_exchanged_claims with an optional RFC 8693 actor token. The actor must be an undelegated token; its scopes further narrow the result, its agent becomes act.sub and azp, the subject’s agent becomes act.act.sub, and the delegation depth grows by two.

check_exchanged_revocation

Check a verified exchanged token in its separate namespace, then check every original identity against JTI and instance revocation rules.

scope_intersection

Compute the intersection of two scope sets, respecting wildcard rules. Returns only scopes that are covered by BOTH inputs.

verify_exchanged_token

Verify a harness-issued token without reading revocation storage.