pub struct Jwk {
pub kid: Option<String>,
pub kty: String,
pub alg: Option<String>,
pub n: Option<String>,
pub e: Option<String>,
pub crv: Option<String>,
pub x: Option<String>,
}Expand description
A JSON Web Key, as published at /jwks.json.
This struct is widened (not an enum) so that every existing call site
that builds a Jwk with a plain struct literal — inside this crate and
downstream — keeps compiling: it only needs two more fields (crv, x),
both None for the RSA shape it already builds. See the to_decoding_key
doc comment for why an enum/#[serde(untagged)] representation was
rejected in favor of this.
Two shapes are represented today:
- RSA (
kty: "RSA"):n,eare populated;crv,xareNone. - OKP/Ed25519 (
kty: "OKP"):crv(always"Ed25519"),xare populated;n,eareNone.
None fields are omitted from the serialized JSON (skip_serializing_if)
so each shape’s wire format matches its RFC exactly: RFC 7517 §6.3.1 for
RSA (kty, n, e), RFC 8037 §2 for OKP (kty, crv, x). Neither
shape ever emits the other’s fields, and neither emits a stray "n":null
/ "x":null.
Fields§
§kid: Option<String>§kty: String§alg: Option<String>§n: Option<String>RSA modulus (base64url, unpadded). None for OKP keys.
e: Option<String>RSA public exponent (base64url, unpadded). None for OKP keys.
crv: Option<String>OKP subtype curve name, e.g. "Ed25519" (RFC 8037 §2). None for
RSA keys.
x: Option<String>OKP public key (base64url, unpadded, RFC 8037 §2). None for RSA
keys.
Implementations§
Source§impl Jwk
impl Jwk
Sourcepub fn to_decoding_key(&self) -> Result<DecodingKey, AuthError>
pub fn to_decoding_key(&self) -> Result<DecodingKey, AuthError>
Derives a DecodingKey from this JWK, dispatching on kty.
Supports "RSA" (unchanged from before this key gained the OKP
shape) and "OKP" with crv: "Ed25519" (RFC 8037). Any other kty,
or an OKP key advertising an unsupported curve, is rejected.