Struct SignedSessionAuthPlugin 

pub struct SignedSessionAuthPlugin { /* private fields */ }

Implementations

impl SignedSessionAuthPlugin

pub fn new(verifier: TokenVerifier) -> Self

Create a new signed session auth plugin

pub fn new_with_async_verifier(verifier: AsyncVerifier) -> Self

Create a signed session auth plugin backed by an async verifier, such as JWKS.

pub fn new_with_multi_key_verifier(verifier: MultiKeyVerifier) -> Self

Create a signed session auth plugin backed by a multi-key verifier for key rotation.

pub fn with_query_param_name(self, name: impl Into<String>) -> Self

Set a custom query parameter name for the token

pub fn with_origin_validation(self) -> Self

Require origin validation (defense-in-depth for browser clients)

pub fn with_audit_logger(self, logger: Arc<dyn SecurityAuditLogger>) -> Self

Set an audit logger for security events

pub fn with_metrics(self, metrics: Arc<AuthMetrics>) -> Self

Set metrics collector for auth operations

pub fn metrics_snapshot(&self) -> Option<AuthMetricsSnapshot>

Get metrics snapshot if metrics are enabled

pub async fn verify_refresh_token( &self, token: &str, ) -> Result<AuthContext, AuthDeny>

Verify a token for in-band refresh and return the auth context

This is used when a client wants to refresh their auth without reconnecting. The origin is NOT validated here - we assume the client has already proven origin at connection time, and we’re just refreshing the session token.

No client IP is known here, so a verifier with client IP validation refuses every token; use Self::verify_refresh_token_from instead.

pub async fn verify_refresh_token_from( &self, token: &str, remote_addr: SocketAddr, ) -> Result<AuthContext, AuthDeny>

Verify a token for in-band refresh on a connection from remote_addr.

Like Self::verify_refresh_token, but IP-bound tokens are checked against the connection’s peer IP.

Trait Implementations

impl WebSocketAuthPlugin for SignedSessionAuthPlugin

fn authorize<'life0, 'life1, 'async_trait>( &'life0 self, request: &'life1 ConnectionAuthRequest, ) -> Pin<Box<dyn Future<Output = AuthDecision> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

fn as_any(&self) -> &dyn Any

fn audit_logger(&self) -> Option<&dyn SecurityAuditLogger>

Get the audit logger if configured

fn auth_metrics(&self) -> Option<&AuthMetrics>

Get auth metrics if configured

fn log_audit<'life0, 'async_trait>( &'life0 self, event: SecurityAuditEvent, ) -> Pin<Box<dyn Future<Output = ()> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Log a security audit event if audit logging is enabled