Struct AuthDispatcher 

pub struct AuthDispatcher { /* private fields */ }

Central dispatcher for JWT and opaque token validation

Orchestrates key providers and claims plugins to validate tokens using a single configured plugin.

Implementations

impl AuthDispatcher

pub fn new( validation_config: ValidationConfig, config: &AuthConfig, registry: &PluginRegistry, ) -> Result<Self, ConfigError>

Create a new dispatcher with validation config and plugin.

Errors

Returns ConfigError::UnknownPlugin if the configured provider is not in the registry.

Examples found in repository

examples/dispatcher_usage.rs (line 171)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut plugins = PluginRegistry::default();
    plugins.register("demo", Arc::new(DemoClaimsPlugin));

    let mut plugin_configs = HashMap::new();
    plugin_configs.insert(
        "demo".to_owned(),
        PluginConfig::Oidc {
            tenant_claim: "tenants".to_owned(),
            roles_claim: "roles".to_owned(),
        },
    );

    let config = AuthConfig {
        mode: AuthModeConfig {
            provider: "demo".to_owned(),
        },
        issuers: vec!["https://issuer.local".to_owned()],
        audiences: vec!["demo-api".to_owned()],
        plugins: plugin_configs,
        ..AuthConfig::default()
    };

    let validation = ValidationConfig {
        allowed_issuers: config.issuers.clone(),
        allowed_audiences: config.audiences.clone(),
        leeway_seconds: config.leeway_seconds,
        require_uuid_subject: true,
        require_uuid_tenants: true,
    };

    let subject = Uuid::new_v4();
    let tenant = Uuid::new_v4();
    let expires_at = OffsetDateTime::now_utc() + Duration::minutes(15);

    let raw_claims = serde_json::json!({
        "iss": "https://issuer.local",
        "sub": subject.to_string(),
        "aud": ["demo-api"],
        "exp": expires_at.unix_timestamp(),
        "tenant_id": tenant.to_string(),
        "roles": ["viewer:read"]
    });

    let dispatcher = AuthDispatcher::new(validation, &config, &plugins)?
        .with_key_provider(Arc::new(StaticKeyProvider::new(raw_claims)));

    let claims = dispatcher.validate_jwt("demo-token").await?;
    let perm_list = if claims.permissions.is_empty() {
        "none".to_owned()
    } else {
        claims
            .permissions
            .iter()
            .map(|p| format!("{}:{}", p.resource_pattern(), p.action()))
            .collect::<Vec<_>>()
            .join(", ")
    };
    println!(
        "Validated token for subject {} with permissions {}",
        claims.subject, perm_list
    );

    Ok(())
}

pub fn with_key_provider(self, provider: Arc<dyn KeyProvider>) -> Self

Add a key provider

Examples found in repository

examples/dispatcher_usage.rs (line 172)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut plugins = PluginRegistry::default();
    plugins.register("demo", Arc::new(DemoClaimsPlugin));

    let mut plugin_configs = HashMap::new();
    plugin_configs.insert(
        "demo".to_owned(),
        PluginConfig::Oidc {
            tenant_claim: "tenants".to_owned(),
            roles_claim: "roles".to_owned(),
        },
    );

    let config = AuthConfig {
        mode: AuthModeConfig {
            provider: "demo".to_owned(),
        },
        issuers: vec!["https://issuer.local".to_owned()],
        audiences: vec!["demo-api".to_owned()],
        plugins: plugin_configs,
        ..AuthConfig::default()
    };

    let validation = ValidationConfig {
        allowed_issuers: config.issuers.clone(),
        allowed_audiences: config.audiences.clone(),
        leeway_seconds: config.leeway_seconds,
        require_uuid_subject: true,
        require_uuid_tenants: true,
    };

    let subject = Uuid::new_v4();
    let tenant = Uuid::new_v4();
    let expires_at = OffsetDateTime::now_utc() + Duration::minutes(15);

    let raw_claims = serde_json::json!({
        "iss": "https://issuer.local",
        "sub": subject.to_string(),
        "aud": ["demo-api"],
        "exp": expires_at.unix_timestamp(),
        "tenant_id": tenant.to_string(),
        "roles": ["viewer:read"]
    });

    let dispatcher = AuthDispatcher::new(validation, &config, &plugins)?
        .with_key_provider(Arc::new(StaticKeyProvider::new(raw_claims)));

    let claims = dispatcher.validate_jwt("demo-token").await?;
    let perm_list = if claims.permissions.is_empty() {
        "none".to_owned()
    } else {
        claims
            .permissions
            .iter()
            .map(|p| format!("{}:{}", p.resource_pattern(), p.action()))
            .collect::<Vec<_>>()
            .join(", ")
    };
    println!(
        "Validated token for subject {} with permissions {}",
        claims.subject, perm_list
    );

    Ok(())
}

pub fn with_introspection_provider( self, provider: Arc<dyn IntrospectionProvider>, ) -> Self

Add an introspection provider

pub async fn validate_jwt(&self, token: &str) -> Result<Claims, ClaimsError>

Validate a JWT token.

Workflow:

1. Try each KeyProvider until one successfully validates the signature
2. Extract issuer from token
3. Use the configured plugin to normalize claims
4. Run common validation (issuer, audience, exp, nbf, UUIDs)
5. Return normalized claims

Errors

Returns ClaimsError if signature validation, claim normalization, or validation fails.

Examples found in repository

examples/dispatcher_usage.rs (line 174)

async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut plugins = PluginRegistry::default();
    plugins.register("demo", Arc::new(DemoClaimsPlugin));

    let mut plugin_configs = HashMap::new();
    plugin_configs.insert(
        "demo".to_owned(),
        PluginConfig::Oidc {
            tenant_claim: "tenants".to_owned(),
            roles_claim: "roles".to_owned(),
        },
    );

    let config = AuthConfig {
        mode: AuthModeConfig {
            provider: "demo".to_owned(),
        },
        issuers: vec!["https://issuer.local".to_owned()],
        audiences: vec!["demo-api".to_owned()],
        plugins: plugin_configs,
        ..AuthConfig::default()
    };

    let validation = ValidationConfig {
        allowed_issuers: config.issuers.clone(),
        allowed_audiences: config.audiences.clone(),
        leeway_seconds: config.leeway_seconds,
        require_uuid_subject: true,
        require_uuid_tenants: true,
    };

    let subject = Uuid::new_v4();
    let tenant = Uuid::new_v4();
    let expires_at = OffsetDateTime::now_utc() + Duration::minutes(15);

    let raw_claims = serde_json::json!({
        "iss": "https://issuer.local",
        "sub": subject.to_string(),
        "aud": ["demo-api"],
        "exp": expires_at.unix_timestamp(),
        "tenant_id": tenant.to_string(),
        "roles": ["viewer:read"]
    });

    let dispatcher = AuthDispatcher::new(validation, &config, &plugins)?
        .with_key_provider(Arc::new(StaticKeyProvider::new(raw_claims)));

    let claims = dispatcher.validate_jwt("demo-token").await?;
    let perm_list = if claims.permissions.is_empty() {
        "none".to_owned()
    } else {
        claims
            .permissions
            .iter()
            .map(|p| format!("{}:{}", p.resource_pattern(), p.action()))
            .collect::<Vec<_>>()
            .join(", ")
    };
    println!(
        "Validated token for subject {} with permissions {}",
        claims.subject, perm_list
    );

    Ok(())
}

pub async fn validate_opaque(&self, token: &str) -> Result<Claims, ClaimsError>

Validate an opaque token via introspection

Workflow:

1. Try each IntrospectionProvider until one succeeds
2. Extract issuer from introspection response
3. Use the configured plugin to normalize claims
4. Run common validation
5. Return normalized claims

Errors

Returns ClaimsError if introspection, claim normalization, or validation fails.

pub fn validation_config(&self) -> &ValidationConfig

Get validation config (for inspection/testing)

pub fn plugin(&self) -> &Arc<dyn ClaimsPlugin>

Get the configured authentication plugin (for inspection/testing)

pub async fn refresh_keys(&self) -> Result<(), Vec<ClaimsError>>

Trigger key refresh for all key providers.

Errors

Returns a vector of ClaimsError if any provider fails to refresh keys.

Trait Implementations

impl TokenValidator for AuthDispatcher

Implement TokenValidator trait for AuthDispatcher

fn validate_and_parse<'life0, 'life1, 'async_trait>( &'life0 self, token: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<Claims, AuthError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Validate a JWT token and return normalized claims