Struct Verifier 

pub struct Verifier { /* private fields */ }

A set of RSA verification keys (indexed by kid) plus the issuer / audience policy applied to every token. Construct once at boot, then share behind an Arc and call verify per request — verification is read-only and allocation-light.

Implementations

impl Verifier

pub fn from_jwks_value( jwks: &Value, issuer: &str, audience: &str, ) -> Result<Self, VerifyError>

Build a verifier from an in-memory JWKS document, validating tokens against issuer (iss) and audience (aud).

Only RSA signing keys are loaded; entries with a non-RSA kty are skipped (the auth-service publishes RS256 only). An empty key set is permitted — it yields a verifier that rejects every token with VerifyError::UnknownKid, which lets a service boot before its JWKS source is reachable without panicking.

Errors

VerifyError::Jwks when the document lacks a keys array, a key is missing kid / n / e, or the modulus/exponent are not valid RSA components.

pub fn key_count(&self) -> usize

Number of RSA verification keys loaded from the JWKS.

pub fn verify(&self, token: &str) -> Result<Claims, VerifyError>

Verify an RS256 bearer token: select the key by the header kid, check the signature, then enforce issuer, audience, and expiry.

Errors

VerifyError::MissingKid / VerifyError::UnknownKid when no key matches, or VerifyError::Jwt when signature/claim validation fails.