Struct TokenManager 

pub struct TokenManager { /* private fields */ }

Central token lifecycle manager: creation, validation, refresh, and revocation.

Constructed internally by AuthFramework — most users interact with token operations through the TokenOperations facade instead.

Implementations

impl TokenManager

pub fn export_public_jwks(&self) -> Result<Vec<JwksPublicKey>>

Export the current and previous RSA verification keys as JWKS-compatible material.

pub fn new_hmac( secret: &[u8], issuer: impl Into<String>, audience: impl Into<String>, ) -> Self

Create a new token manager with HMAC key.

pub fn new_rsa( private_key: &[u8], public_key: &[u8], issuer: impl Into<String>, audience: impl Into<String>, ) -> Result<Self>

Create a new token manager with RSA keys.

RSA Key Format Support

This method supports RSA keys in both standard PEM formats:

• PKCS#1: -----BEGIN RSA PRIVATE KEY----- (traditional RSA format)
• PKCS#8: -----BEGIN PRIVATE KEY----- (modern standard format, recommended)

Both formats are automatically detected and parsed. No format conversion is required.

Example

use auth_framework::tokens::TokenManager;

// Both PKCS#1 and PKCS#8 formats work; provide PEM bytes from your key store.

let manager = TokenManager::new_rsa(
    private_key,
    public_key,
    "my-service",
    "my-audience"
)?;

pub fn rotate_hmac_key(&mut self, new_secret: &[u8])

Rotate HMAC key, keeping the current key as the previous decoding key to seamlessly allow verification of tokens signed with the old key.

pub fn rotate_rsa_key( &mut self, private_key: &[u8], public_key: &[u8], ) -> Result<()>

Rotate RSA key, keeping the current key as the previous decoding key to seamlessly allow verification of tokens signed with the old key.

pub fn retire_previous_key(&mut self)

Retire the previous key (if any), so tokens signed with it are no longer valid.

pub fn with_default_lifetime(self, lifetime: Duration) -> Self

Set the default token lifetime.

pub fn create_jwt_token( &self, user_id: impl Into<String>, scopes: Vec<String>, lifetime: Option<Duration>, ) -> Result<String>

Create a new JWT token.

pub fn validate_jwt_token(&self, token: &str) -> Result<JwtClaims>

Validate and decode a JWT token.

pub fn create_auth_token( &self, user_id: impl Into<String>, scopes: impl Into<Scopes>, auth_method: impl Into<String>, lifetime: Option<Duration>, ) -> Result<AuthToken>

Create a complete authentication token with JWT.

pub fn validate_auth_token(&self, token: &AuthToken) -> Result<()>

Validate an authentication token.

pub fn refresh_token(&self, token: &AuthToken) -> Result<AuthToken>

Refresh a token (create a new one with extended lifetime).

pub fn extract_token_info(&self, token: &str) -> Result<TokenInfo>

Extract token information from a JWT.

Trait Implementations

impl Clone for TokenManager

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.