Struct AuthClient 

pub struct AuthClient { /* private fields */ }

Verifies tokens issued by one auth instance, for one registered client.

Implementations

impl AuthClient

pub fn new( http: Arc<dyn HttpClient>, clock: Arc<dyn Clock>, issuer: impl Into<String>, client_id: impl Into<String>, ) -> Self

issuer is the auth service’s base URL, exactly as it appears in the iss claim. client_id is this app’s registered id, and is what every token’s aud must equal.

pub async fn verify(&self, token: &str) -> Result<Claims, VerifyError>

Verifies a bearer token and returns its claims.

On an unknown key id the key set is refetched once — that is what makes rotation invisible to a running app — but no more often than crate::JWKS_MIN_REFETCH_SECS.

Errors

VerifyError describing the first check that failed. Callers should log it and answer 401 without saying which.

Trait Implementations

impl Auth for AuthClient

fn identify<'life0, 'life1, 'async_trait>( &'life0 self, headers: &'life1 HeaderMap, ) -> Pin<Box<dyn Future<Output = Result<Caller, AuthError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Identifies the caller from an Authorization: Bearer header.

No header is Caller::Anonymous. A header that is present and does not verify is AuthError::NotVerified — never anonymity, which would let an expired token read a public table and tell its holder nothing was wrong.

AuthError::Unavailable is never returned here, and that is a property of the verifier rather than an omission: a JWKS fetch that fails leaves the previously fetched keys in place, so an unreachable auth service does not invalidate a running app’s sessions. The one case it cannot cover is a cold start that has never fetched a key set, where every token is an unknown key and so a refusal.