Struct DpopResourceGuard 

pub struct DpopResourceGuard { /* private fields */ }

Enforces DPoP proof-of-possession on a protected route (the resource-server side of RFC 9449). Reads the access token’s cnf.jkt (already decoded onto RequestContext by the boundary), the request’s DPoP proof header, and the method + reconstructed URI, then verifies the proof and confirms the thumbprint binding.

Not a sync Guard — an async guard, like DistributedRateLimit

The framework’s Guard trait is synchronous and zero-I/O by design (it inspects already-decoded claims). A DPoP check must do per-request I/O — the single-use jti replay lookup — so it cannot be a Guard. It follows the same shape the framework already uses for DistributedRateLimit: an async method awaited at the top of the handler (dpop.enforce(&ctx).await?), returning an error that converts to an HTTP response. This is an established pattern in the codebase, not a new one.

Default posture is downgrade-safe: a token without cnf.jkt (a plain bearer token) passes — an attacker can’t strip cnf from a signed bound token to bypass the check. Call require_bound to also reject unbound tokens (all access tokens must be DPoP).

Implementations

impl DpopResourceGuard

pub fn new(verifier: Arc<DpopVerifier>) -> Self

pub fn default_scheme(self, scheme: &'static str) -> Self

Scheme used to reconstruct the request URI when X-Forwarded-Proto is absent (default "https"). Set "http" for local development.

pub fn require_bound(self) -> Self

Reject access tokens that are not sender-constrained (no cnf.jkt), so every request on the route must present a DPoP proof.

pub async fn enforce(&self, ctx: &RequestContext) -> Result<()>

Enforce the binding for the current request.

pub async fn enforce_parts( &self, cnf_jkt: &str, dpop_header: &str, method: &str, htu: &str, ) -> Result<()>

The pure core: verify dpop_header against method/htu and confirm it matches cnf_jkt. Exposed so callers can bind to a URI they compute themselves (e.g. behind an unusual proxy setup).