Struct JwtPlugin 

pub struct JwtPlugin { /* private fields */ }

Issue session JWTs with keys persisted through JwksStore.

Implementations

impl JwtPlugin

pub fn callbacks<S: AuthSchema>( self, callbacks: JwtCallbacks<S>, ) -> impl AuthPlugin<S>

Attach schema-aware key adapter callbacks after configuring plugin options.

impl JwtPlugin

pub async fn sign<S: AuthSchema>( &self, payload: Map<String, Value>, ctx: &AuthContext<S>, ) -> AuthResult<String>

Sign an application payload with the same persisted keys as /token.

pub async fn sign_with_options<S: AuthSchema>( &self, payload: Map<String, Value>, options: &JwtSigningOptions, ctx: &AuthContext<S>, ) -> AuthResult<String>

Sign a native payload with explicit protected headers and key selection. Use sign_in_endpoint to retain an endpoint request and transaction.

pub async fn sign_in_endpoint<S: AuthSchema>( &self, payload: Map<String, Value>, options: &JwtSigningOptions, endpoint: &EndpointContext<'_, S>, ) -> AuthResult<String>

Sign with the supplied endpoint context, including its active transaction.

impl JwtPlugin

pub async fn verify<S: AuthSchema>( &self, token: &str, issuer: Option<&str>, ctx: &AuthContext<S>, ) -> AuthResult<Option<Map<String, Value>>>

Verify a token with adapter keys. Invalid tokens and verification adapter errors return None.

The optional issuer overrides the configured issuer. Like upstream verifyJWT, this reads local adapter keys even when remote_url is configured.

pub async fn verify_in_endpoint<S: AuthSchema>( &self, token: &str, issuer: Option<&str>, endpoint: &EndpointContext<'_, S>, ) -> AuthResult<Option<Map<String, Value>>>

Verify with the supplied endpoint context and its key-adapter callbacks.

impl JwtPlugin

pub fn new() -> Self

pub fn with_config(config: JwtPluginConfig) -> Self

pub fn session_cookie_cache(self, val: bool) -> Self

pub fn modulus_length(self, val: u32) -> Self

pub fn key_pair_configs(self, val: Vec<JwtKeyPairConfig>) -> Self

pub fn remote_url(self, val: String) -> Self

pub fn custom_sign(self, val: JwtCustomSign) -> Self

pub fn define_payload(self, val: JwtDefinePayload) -> Self

pub fn get_subject(self, val: JwtGetSubject) -> Self

pub fn jwks_path(self, val: impl Into<String>) -> Self

pub fn algorithm(self, val: JwtAlgorithm) -> Self

pub fn issuer(self, val: String) -> Self

pub fn audience(self, val: JwtAudience) -> Self

pub fn rotation_interval(self, val: Duration) -> Self

pub fn grace_period(self, val: Duration) -> Self

pub fn disable_private_key_encryption(self, val: bool) -> Self

pub fn disable_setting_jwt_header(self, val: bool) -> Self

impl JwtPlugin

pub fn expiration_time(self, expiration: impl Into<JwtExpiration>) -> Self

Set a relative duration, an absolute date, or a NumericDate in seconds.

impl JwtPlugin

pub async fn create_key_pair<S: AuthSchema>( &self, parameters: JwtKeyPairConfig, ctx: &AuthContext<S>, ) -> AuthResult<Jwk>

Provision a local key with explicit parameters.

pub async fn create_key_pair_in_endpoint<S: AuthSchema>( &self, parameters: JwtKeyPairConfig, endpoint: &EndpointContext<'_, S>, ) -> AuthResult<Jwk>

Provision a key with the supplied endpoint context and active transaction.

Trait Implementations

impl<S: AuthSchema> AuthPlugin<S> for JwtPlugin

fn name(&self) -> &'static str

Plugin name - should be unique

fn routes(&self) -> Vec<AuthRoute>

Routes that this plugin handles

fn on_init<'life0, 'life1, 'async_trait>( &'life0 self, ctx: &'life1 mut AuthInitContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called when the plugin is initialized

fn on_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each request - return Some(response) to handle, None to pass through

fn after_request<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, response: &'life2 mut AuthResponse, ctx: &'life3 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Inspect or extend the final route response after session cookies are applied.

fn telemetry_plugin_id(&self) -> Option<&'static str>

Return the upstream plugin ID; core option wrappers have no plugin ID.

fn openapi(&self) -> Result<OpenApiPluginMetadata, AuthError>

Document this configured plugin without invoking application field policies.

fn password_hasher(&self) -> Option<Arc<dyn PasswordHasher>>

Select the base password hasher before plugin initialization wraps it.

fn telemetry(&self, _options: &mut PluginTelemetry)

Report configured options without invoking callbacks or initializing the plugin.

fn rate_limits(&self) -> Result<Vec<PluginRateLimit>, AuthError>

Default endpoint limits, overridden by explicit application limits.

fn on_http_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect an HTTP request after rate limiting and before endpoint middleware. Native API calls do not run this hook. A response skips endpoint hooks.

fn on_http_response<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _response: &'life2 mut AuthResponse, _ctx: &'life3 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, Self: 'async_trait,

Inspect the HTTP router response, including route misses and body errors. Early HTTP request responses and native endpoint calls skip this hook. A replacement response stops the remaining HTTP response hooks.

fn before_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<BeforeRequestAction>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called for a registered endpoint after HTTP body decoding and origin checks.

impl Default for JwtPlugin

fn default() -> Self

Returns the “default value” for a type.