Struct SignedUrlKeySet 

pub struct SignedUrlKeySet { /* private fields */ }

One or more (kid, secret) HMAC keys valid for signed-URL verification — see the module docs for the wire form and canonical string, and crate::Verifier::signed_url for wiring one into a crate::Verifier.

Multiple keys may be active simultaneously (key rotation, issue #747): verification looks the token’s kid up in this set and rejects an unrecognised one rather than falling back to any other configured key.

Implementations

impl SignedUrlKeySet

pub const MIN_SECRET_LEN: usize = 32

The minimum accepted secret length, in bytes (32 — enough entropy that brute-forcing the HMAC key is infeasible). Enforced by Self::new at construction time, never per-request.

pub fn new(keys: impl IntoIterator<Item = (String, Vec<u8>)>) -> Result<Self>

Builds a keyset from (kid, secret) pairs.

Rejects (before constructing anything) the first key whose secret is shorter than Self::MIN_SECRET_LEN bytes, with Error::SignedUrlKeyTooShort naming the offending kid and lengths — this is a setup/config-time error, not something a request can trigger.

Duplicate kids are not rejected; the internal lookup (used by both Self::sign and verification) returns the first match, so a duplicate is effectively shadowed rather than causing ambiguity.

pub fn sign( &self, kid: &str, path: &str, exp: u64, ip: Option<IpAddr>, ) -> Result<String>

Signing helper: mints the query-string portion of a signed URL for kid/path/exp/ip — ?-prefix and the resource path are the caller’s own to assemble (e.g. format!("{path}?{query}")), since this returns just the exp=...&kid=...&sig=...[&ip=...] part.

path must be exactly the request path the eventual request’s RequestContext::uri carries (sans query string) — see the module docs’ canonical-string rule. ip, if given, is rendered via IpAddr’s canonical Display form in both the signed string and the ip query parameter — not whatever string representation a caller might otherwise have on hand — so that crate::Verifier::verify’s re-parse-then-re-render of the ip it receives back always reproduces the exact bytes that were signed.

Fails with Error::UnknownSignedUrlKeyId if kid is not in this keyset. This is the signing side (used by tests and by whatever mints tokens for real clients) — crate::Verifier::verify never returns this error; an unknown kid there is folded into the same crate::AuthResult::Unauthorized as every other rejection reason.

Trait Implementations

impl Debug for SignedUrlKeySet

Manual Debug (rather than #[derive(Debug)]): every entry carries a secret that must never render verbatim — only the configured kids are shown, which is exactly what’s useful for diagnosing a rotation.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.