Struct JwtAuthInterceptor 

pub struct JwtAuthInterceptor { /* private fields */ }

A ServerInterceptor that authenticates requests with a signed JWT.

Reads Authorization: Bearer <jwt>, validates it with the configured JwtValidator, and rejects the request (generically) on any failure.

Implementations

impl JwtAuthInterceptor

pub const fn new(validator: JwtValidator, jwks: Jwks) -> JwtAuthInterceptor

Creates an interceptor with a fixed key set.

Use an empty Jwks when validating HS256-only (the secret lives on the validator).

pub fn from_jwks_url( validator: JwtValidator, jwks_url: impl Into<String>, ) -> JwtAuthInterceptor

Creates an interceptor that fetches keys from a JWKS URL, caching them for ttl (default 1 hour) and refetching once on a key-id miss (key rotation).

The keys are not fetched here — the first request triggers the fetch.

pub fn from_jwks_url_with_tls_config( validator: JwtValidator, jwks_url: impl Into<String>, tls_config: ClientConfig, ) -> JwtAuthInterceptor

Like from_jwks_url, but with a caller-supplied rustls ClientConfig for the JWKS fetch — for identity providers behind a private CA, where the default webpki-roots trust store cannot verify the JWKS endpoint.

pub async fn from_oidc_issuer( issuer: &str, validator: JwtValidator, ) -> Result<JwtAuthInterceptor, A2aError>

Discovers the issuer’s jwks_uri via OIDC discovery ({issuer}/.well-known/openid-configuration) and builds a remote-JWKS interceptor for it.

Errors

Returns an A2aError when discovery fails or the document has no jwks_uri.

pub fn with_jwks_ttl(self, ttl: Duration) -> JwtAuthInterceptor

Sets the remote-JWKS cache TTL. No-op for a static key set.

Trait Implementations

impl Debug for JwtAuthInterceptor

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl ServerInterceptor for JwtAuthInterceptor

fn before<'a>( &'a self, ctx: &'a CallContext, ) -> Pin<Box<dyn Future<Output = Result<(), A2aError>> + Send + 'a>>

Called before the request handler processes the method call.

fn after<'a>( &'a self, _ctx: &'a CallContext, ) -> Pin<Box<dyn Future<Output = Result<(), A2aError>> + Send + 'a>>

Called after the request handler has finished processing.

fn authenticates(&self) -> bool

Returns true if this interceptor authenticates requests — i.e. its before hook rejects callers that do not present valid credentials.