rewrite AssumeRoleHandle

iam/src/auth/credentials.rs

@@ -177,22 +177,17 @@ pub fn generate_credentials() -> Result<(String, String)> {
     Ok((ak, sk))
 }
 
-pub fn get_new_credentials_with_metadata<T: Serialize>(
-    claims: &T,
-    token_secret: &str,
-    exp: Option<usize>,
-) -> Result<Credentials> {
+pub fn get_new_credentials_with_metadata(claims: &HashMap<String, Value>, token_secret: &str) -> Result<Credentials> {
     let (ak, sk) = generate_credentials()?;
 
-    create_new_credentials_with_metadata(&ak, &sk, claims, token_secret, exp)
+    create_new_credentials_with_metadata(&ak, &sk, claims, token_secret)
 }
 
-pub fn create_new_credentials_with_metadata<T: Serialize>(
+pub fn create_new_credentials_with_metadata(
     ak: &str,
     sk: &str,
-    claims: &T,
+    claims: &HashMap<String, Value>,
     token_secret: &str,
-    exp: Option<usize>,
 ) -> Result<Credentials> {
     if ak.len() < ACCESS_KEY_MIN_LEN || ak.len() > ACCESS_KEY_MAX_LEN {
         return Err(Error::new(IamError::InvalidAccessKeyLength));
@@ -202,6 +197,18 @@ pub fn create_new_credentials_with_metadata<T: Serialize>(
         return Err(Error::new(IamError::InvalidAccessKeyLength));
     }
 
+    let expiration = {
+        if let Some(v) = claims.get("exp") {
+            if let Some(expiry) = v.as_i64() {
+                Some(OffsetDateTime::from_unix_timestamp(expiry)?.to_offset(OffsetDateTime::now_local()?.offset()))
+            } else {
+                None
+            }
+        } else {
+            None
+        }
+    };
+
     let token = utils::generate_jwt(claims, token_secret)?;
 
     Ok(Credentials {
@@ -209,7 +216,7 @@ pub fn create_new_credentials_with_metadata<T: Serialize>(
         secret_key: sk.to_owned(),
         session_token: token,
         status: ACCOUNT_ON.to_owned(),
-        expiration: exp.map(|v| OffsetDateTime::now_utc().saturating_add(Duration::seconds(v as i64))),
+        expiration,
         ..Default::default()
     })
 }

iam/src/manager.rs

@@ -773,7 +773,14 @@ where
     }
 
     pub async fn set_temp_user(&self, access_key: &str, cred: &Credentials, policy_name: Option<&str>) -> Result<OffsetDateTime> {
-        if access_key.is_empty() || cred.is_temp() || cred.is_expired() || cred.parent_user.is_empty() {
+        if access_key.is_empty() || !cred.is_temp() || cred.is_expired() || cred.parent_user.is_empty() {
+            error!(
+                "set temp user invalid argument, access_key: {},  is_temp: {}, is_expired: {}, parent_user_empty: {}",
+                access_key,
+                cred.is_temp(),
+                cred.is_expired(),
+                cred.parent_user.is_empty()
+            );
             return Err(Error::new(IamError::InvalidArgument));
         }
 

iam/src/sys.rs

@@ -210,14 +210,14 @@ impl<T: Store> IamSys<T> {
             Vec::new()
         };
 
-        let mut m = HashMap::new();
-        m.insert("parent".to_owned(), parent_user.to_owned());
+        let mut m: HashMap<String, Value> = HashMap::new();
+        m.insert("parent".to_owned(), serde_json::Value::String(parent_user.to_owned()));
 
         if !policy_buf.is_empty() {
-            m.insert(SESSION_POLICY_NAME.to_owned(), base64_encode(&policy_buf));
-            m.insert(iam_policy_claim_name_sa(), EMBEDDED_POLICY_TYPE.to_owned());
+            m.insert(SESSION_POLICY_NAME.to_owned(), serde_json::Value::String(base64_encode(&policy_buf)));
+            m.insert(iam_policy_claim_name_sa(), serde_json::Value::String(EMBEDDED_POLICY_TYPE.to_owned()));
         } else {
-            m.insert(iam_policy_claim_name_sa(), INHERITED_POLICY_TYPE.to_owned());
+            m.insert(iam_policy_claim_name_sa(), serde_json::Value::String(INHERITED_POLICY_TYPE.to_owned()));
         }
 
         if let Some(claims) = opts.claims {
@@ -234,7 +234,7 @@ impl<T: Store> IamSys<T> {
             generate_credentials()?
         };
 
-        let mut cred = create_new_credentials_with_metadata(&access_key, &secret_key, &m, &secret_key, None)?;
+        let mut cred = create_new_credentials_with_metadata(&access_key, &secret_key, &m, &secret_key)?;
         cred.parent_user = parent_user.to_owned();
         cred.groups = Some(groups);
         cred.status = ACCOUNT_ON.to_owned();
@@ -671,7 +671,7 @@ pub struct NewServiceAccountOpts {
     pub description: Option<String>,
     pub expiration: Option<OffsetDateTime>,
     pub allow_site_replicator_account: bool,
-    pub claims: Option<HashMap<String, String>>,
+    pub claims: Option<HashMap<String, Value>>,
 }
 
 pub struct UpdateServiceAccountOpts {