Struct JwtValidator 

pub struct JwtValidator { /* private fields */ }

JWT token validator.

Supports three key sources (checked in order):

1. Static secret or RSA PEM key
2. JWKS cache (fetched from OIDC discovery or direct JWKS URL)

Implementations

impl JwtValidator

pub fn new(config: JwtConfig) -> Result<Self, AuthError>

Create a new JWT validator from configuration.

Errors

Returns AuthError::Config if the configured algorithm string is unrecognized (fail-closed).

pub fn with_jwks_cache(self, cache: Arc<JwksCache>) -> Self

Attach a JwksCache for dynamic OIDC key resolution.

When set, validate_async will try the JWKS cache if no static key is configured (or if static validation fails).

pub fn jwks_cache(&self) -> Option<&Arc<JwksCache>>

Returns a reference to the attached JWKS cache, if any.

pub fn validate(&self, token: &str) -> Result<JwtClaims, AuthError>

Validate a JWT token string and return the claims.

pub async fn validate_async(&self, token: &str) -> Result<JwtClaims, AuthError>

Validate a JWT token with JWKS cache support (async).

Resolution order:

1. Try static key (secret / RSA PEM) if configured.
2. Fall back to the JWKS cache: decode the JWT header to extract kid, fetch the matching key from the cache, and validate.
3. If no kid header, try all cached keys.

pub fn role_claim(&self) -> &str

Extract the principal identity from JWT claims. The claim path roles are read from (roles unless configured).

pub fn extract_roles(&self, claims: &JwtClaims) -> Vec<String>

The roles this token carries, as Chronix::Role names.

Resolved here rather than at a gate, so every gate sees the same set. The administrative gate used to do it alone, which is why a role granted an admin operation and matched nothing in a namespace policy.

Accepts an array of strings, or a single string — identity providers emit both, and a one-element list is often flattened on the way through. A space-separated string is not split: scope is space-separated and roles is not, and guessing turns one role named "data science" into two that do not exist.

pub fn extract_principal(&self, claims: &JwtClaims) -> Option<String>

The principal this token names, from subject_claim (default sub).

Trait Implementations

impl Clone for JwtValidator

fn clone(&self) -> JwtValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwtValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.