tokenkit 1.0.0

Type-safe JWT encode/decode for Rust: configurable validation, secret rotation, key rotation, and revocation support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

use thiserror::Error;

/// Errors that can occur during JWT operations.
#[derive(Debug, Error)]
pub enum JwtError {
    /// Failed to encode the JWT token.
    #[error("failed to encode JWT")]
    EncodingFailed,

    /// Failed to decode the JWT token.
    #[error("failed to decode JWT: {0}")]
    DecodingFailed(String),

    /// The token has expired.
    #[error("token has expired")]
    Expired,

    /// The token signature is invalid.
    #[error("invalid signature")]
    InvalidSignature,

    /// The token has been revoked.
    #[error("token has been revoked")]
    Revoked,

    /// The signing secret or key is invalid.
    #[error("invalid secret or key: {0}")]
    InvalidSecret(String),

    /// Failed to load the signing key from disk.
    #[error("failed to load signing key: {0}")]
    KeyLoading(String),

    /// Failed to fetch, parse, or resolve a key from a JWKS set.
    #[error("JWKS error: {0}")]
    Jwks(String),

    /// The token's `alg` header does not match the algorithm advertised by
    /// the key (`alg` member of the JWK). This is the algorithm-confusion
    /// defense for JWKS-sourced keys: a key published for one algorithm
    /// must never verify tokens claiming another.
    #[error("algorithm mismatch: token header `{token_alg}` vs key `{key_alg}`")]
    AlgorithmMismatch {
        /// Algorithm claimed by the token header.
        token_alg: String,
        /// Algorithm advertised by the key.
        key_alg: String,
    },
}