Struct JwtConfig 

pub struct JwtConfig { /* private fields */ }

Cheap-to-clone JWT configuration. Wrap with Arc internally so all clones share the same active-key + history view.

Implementations

impl JwtConfig

pub fn new(issuer: String, audience: Vec<String>) -> Self

Empty configuration — no keys yet. Caller must populate via JwtConfig::load_from_postgres / JwtConfig::load_from_sqlite or JwtConfig::set_active before issuing tokens.

pub fn set_active(&self, active: ActiveKey, history: Vec<HistoryKey>)

Replace the in-memory active key + history. Useful in tests where we want a single ephemeral keypair without round-tripping the DB.

pub fn issue<T: Serialize>(&self, claims: &T) -> Result<String>

Sign claims with the active key. The active key’s kid is written into the JWT header so verify can look it up.

pub fn verify<T: DeserializeOwned>(&self, token: &str) -> Result<TokenData<T>>

Verify token and decode its claims. Looks up the decoding key by header kid (active first, then history), validates iss and the audience list against the in-memory configuration.

pub fn active_kid(&self) -> Option<String>

Borrow the active key’s kid (cheap clone). Useful in tests and for telemetry.

pub fn issuer(&self) -> String

Configured issuer string. Plan-locked: every JWT this config signs must carry this iss claim. Useful for downstream callers (e.g. the BW-compat shim in assay-vault) that mint their own claim shapes but still need verify to accept the token.

pub fn audience(&self) -> Vec<String>

Configured audience list (cheap clone — typical size 1).

pub async fn load_from_postgres(&self, pool: &PgPool) -> Result<()>

Load every key from auth.jwks_keys into memory. The row with rotated_at IS NULL becomes active; the rest become history. private_pem_encrypted is treated as plaintext PEM for now — encryption-at-rest is a later phase.

pub async fn load_from_sqlite(&self, pool: &SqlitePool) -> Result<()>

SQLite mirror of JwtConfig::load_from_postgres.

pub async fn rotate_postgres(&self, pool: &PgPool) -> Result<String>

Generate a fresh Ed25519 keypair, INSERT it into auth.jwks_keys as the new active row, mark the prior active row rotated, and swap the in-memory state. Returns the new kid.

pub async fn rotate_sqlite(&self, pool: &SqlitePool) -> Result<String>

SQLite mirror of JwtConfig::rotate_postgres.

Trait Implementations

impl Clone for JwtConfig

fn clone(&self) -> JwtConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.