Struct TokenResponse 

#[non_exhaustive]
pub struct TokenResponse {
    pub access_token: String,
    pub token_type: String,
    pub expires_in: Option<i64>,
    pub scope: String,
    pub refresh_token: String,
    pub issued_token_type: String,
    pub cnf: Option<Value>,
    pub cnf_jkt: String,
}

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

access_token: String

token_type: String

expires_in: Option<i64>

AS-supplied lifetime hint in seconds (RFC 6749 §5.1).

• None — the AS omitted the field. The cache layer applies its configured default_ttl.
• Some(0) — the AS asked for immediate expiry (RFC 6749 §5.1 permits this for one-shot flows). The cache refuses to store.
• Some(n) with n > 0 — use n seconds, then apply the buffer.

On the wire, None is omitted entirely (the field is absent from the JSON), matching what the AS would have sent — so serializing a cached TokenResponse round-trips through the same parse path that produced it.

match resp.expires_in {
    None => { /* AS gave no hint — apply default TTL */ }
    Some(0) => { /* explicit immediate expiry — do not cache */ }
    Some(_n) => { /* use n seconds */ }
}

scope: String

refresh_token: String

issued_token_type: String

cnf: Option<Value>

Raw cnf (confirmation) object from the token response when present. RFC 9449 §6.1 places cnf.jkt here for DPoP-bound tokens; this field preserves any extension members (x5t#S256, future additions) verbatim. Only Some when the AS sent a JSON object; non-object cnf values are dropped.

cnf_jkt: String

Convenience accessor for the DPoP key thumbprint at cnf.jkt (RFC 9449 §6.1). Empty string when the token is not DPoP-bound. Always derived from cnf.jkt on deserialize via #[serde(from = "TokenResponseWire")], matching the imperative parse_token_response_inner path through extract_cnf_and_jkt — a top-level cnf_jkt on the wire is not honoured, so a poisoned blob that disagrees with its own cnf object cannot mint a mismatched thumbprint.

Trait Implementations

impl Clone for TokenResponse

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenResponse

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TokenResponse

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for TokenResponse

impl From<CachedToken> for TokenResponse

fn from(cached: CachedToken) -> Self

Rehydrate a TokenResponse from a cached entry. refresh_token and issued_token_type default to empty — client_credentials responses never carry them. cnf and cnf_jkt are preserved verbatim from the cache so a DPoP-bound token still looks DPoP-bound on cache hits.

impl PartialEq for TokenResponse

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for TokenResponse

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for TokenResponse