Struct JwtValidator 

pub struct JwtValidator { /* private fields */ }

JWT token validator.

Supports three key sources (checked in order):

1. Static secret or RSA PEM key
2. JWKS cache (fetched from OIDC discovery or direct JWKS URL)

Implementations

impl JwtValidator

pub fn new(config: JwtConfig) -> Result<Self, AuthError>

Create a new JWT validator from configuration.

Errors

Returns AuthError::Config if the configured algorithm string is unrecognized (fail-closed).

pub fn with_jwks_cache(self, cache: Arc<JwksCache>) -> Self

Attach a JwksCache for dynamic OIDC key resolution.

When set, validate_async will try the JWKS cache if no static key is configured (or if static validation fails).

pub fn jwks_cache(&self) -> Option<&Arc<JwksCache>>

Returns a reference to the attached JWKS cache, if any.

pub fn validate(&self, token: &str) -> Result<JwtClaims, AuthError>

Validate a JWT token string and return the claims.

pub async fn validate_async(&self, token: &str) -> Result<JwtClaims, AuthError>

Validate a JWT token with JWKS cache support (async).

Resolution order:

1. Try static key (secret / RSA PEM) if configured.
2. Fall back to the JWKS cache: decode the JWT header to extract kid, fetch the matching key from the cache, and validate.
3. If no kid header, try all cached keys.

pub fn extract_principal(&self, claims: &JwtClaims) -> Option<String>

Extract the principal identity from JWT claims.

Trait Implementations

impl Clone for JwtValidator

fn clone(&self) -> JwtValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwtValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.