Crate authentication_verifier 

Offline RS256 JWT verification against the authentication-service JWKS.

The authentication-service is the federation’s single auth provider. It signs RS256 access tokens and publishes its public keys at /.well-known/jwks.json. Every other service verifies those tokens offline: fetch the JWKS once at boot, build a Verifier, then call Verifier::verify per request. There is no shared secret and no per-request introspection call.

This crate is the peer-side mirror of the auth-service’s own auth::verify_token: same RS256 algorithm, same Claims shape, same kid selection — but keyed off the published JWKS rather than a locally held private key, so any service can embed it.

let jwks: serde_json::Value = serde_json::json!({ "keys": [] });
let verifier = Verifier::from_jwks_value(&jwks, "authentication-service", "main-x-service")?;
let claims = verifier.verify("eyJhbGci...")?;
println!("authenticated subject: {}", claims.sub);

Structs

Claims

Verified token claims. Mirrors the auth-service Claims exactly so a token signed there round-trips here. sub carries the user pid.

Verifier

A set of RSA verification keys (indexed by kid) plus the issuer / audience policy applied to every token. Construct once at boot, then share behind an Arc and call verify per request — verification is read-only and allocation-light.

Enums

VerifyError

Failure modes for JWKS loading and token verification.