Struct KeySetVerifier 

pub struct KeySetVerifier { /* private fields */ }

Verifies access tokens against a key set. Cheap to clone.

Implementations

impl KeySetVerifier

pub fn from_key_set(keys: KeySet) -> Self

A fixed key set (in-process, tests, an edge with keys baked in).

pub fn from_cache(cache: Arc<JwksCache>) -> Self

A live W159 cache; a kid-miss triggers its rate-limited refetch.

pub fn from_issuer_key( kid: impl Into<String>, public_key: &[u8; 32], issuer: impl Into<String>, ) -> Self

One issuer-role key, owned by issuer. The static set an in-process cheers surface verifies its own platform key with.

pub async fn verify<T: DeserializeOwned>( &self, token: &str, now: i64, expected_iss: &str, expected_aud: Option<&str>, ) -> Result<T, VerifyError>

Verify token at now and return its payload as T.

Checks, in order: footer kid, key lookup, role (assertion keys refused before any crypto), signature, iss == expected_iss, aud == expected_aud when Some, expiry, then the self-signer rules.

pub async fn verify_mcp( &self, token: &str, now: i64, expected_iss: &str, expected_aud: Option<&str>, ) -> Result<McpClaims, VerifyError>

verify into cheers’s own McpClaims.

pub async fn verify_artifact<T: SignedArtifact>( &self, token: &str, ) -> Result<T, VerifyError>

Verify a SignedArtifact (R732-F6) and return its payload.

The footer kid must name an issuer-role key (assertion and self-signer keys are refused before any crypto), the signature must carry T::IMPLICIT_ASSERTION — so an access token never verifies here and an artifact never verifies in verify — and the payload’s issuer must be the key’s owner. There is no clock check: artifacts have no edge-enforced expiry (noisetable W235 §0.1).

pub fn key_set(&self) -> Arc<KeySet>

The keys this verifier trusts right now — the static set, or the cache’s current one. Persist KeySet::doc and rebuild with KeySet::from_doc + from_key_set to verify offline against exactly these keys (R732-F5; see IssuerTrust::export).

Trait Implementations

impl Clone for KeySetVerifier

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeySetVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.