Struct TestSession 

pub struct TestSession { /* private fields */ }

Available on crate feature testing only.

A Clerk session to mint a token for.

Defaults to a currently-valid personal-account session: a sid, an iat and nbf of now, and an exp one minute out. Every part is overridable, including into shapes the verifier is supposed to reject — see expired and without_session_id.

Implementations

impl TestSession

pub fn new(user_id: impl Into<String>) -> Self

A currently-valid session for user_id, with a derived sid.

pub fn with_session_id(self, session_id: impl Into<String>) -> Self

Overrides the sid session id claim.

pub fn without_session_id(self) -> Self

Omits the sid claim, producing a token shaped like a Clerk JWT-template token rather than a session token.

Verification rejects these by default, so this is how to test that an endpoint is not accepting them (or, with allow_non_session_tokens, that it deliberately does).

pub fn with_issuer(self, issuer: impl Into<String>) -> Self

Sets the iss claim, to test add_issuer pinning.

pub fn with_audience(self, audience: impl Into<String>) -> Self

Sets the aud claim, to test add_audience.

pub fn with_authorized_party(self, authorized_party: impl Into<String>) -> Self

Sets the azp claim, to test add_authorized_party.

pub fn with_lifetime(self, lifetime: Duration) -> Self

Sets how long after iat the token expires. Defaults to one minute.

pub fn with_issued_at(self, issued_at: i64) -> Self

Pins iat and nbf to a fixed Unix timestamp instead of now.

pub fn with_not_before(self, not_before: i64) -> Self

Pins nbf to a fixed Unix timestamp, independent of iat.

Set it in the future to produce a not-yet-valid token.

pub fn with_expires_at(self, expires_at: i64) -> Self

Pins exp to a fixed Unix timestamp, ignoring with_lifetime.

pub fn expired(self) -> Self

Makes the token already expired, for testing rejection and refresh paths.

Backdates iat/nbf far enough that the token is expired well beyond the configured clock skew.

pub fn with_organization(self, organization_id: impl Into<String>) -> Self

Puts the session in an organization.

Emits Clerk’s v2 o claim by default; see with_v1_organization_claims for the older flat shape.

pub fn with_organization_slug(self, slug: impl Into<String>) -> Self

Sets the organization slug (o.slg, or org_slug on v1).

pub fn with_organization_role(self, role: impl Into<String>) -> Self

Sets the organization role (o.rol, or org_role on v1).

Accepts either admin or org:admin; verification normalizes both to the org:-prefixed form.

pub fn with_organization_permissions( self, permissions: impl IntoIterator<Item = impl Into<String>>, ) -> Self

Sets the organization permissions, as org:<feature>:<permission> strings such as org:dashboard:read.

On v2 these are encoded into Clerk’s packed fea/per/fpm claim trio, which is what the verifier decodes back into ClerkAuth::org_permissions. A permission not in that three-part form is an error at sign time, since it could not round-trip.

pub fn with_v1_organization_claims(self) -> Self

Emits pre-v2 flat org_id / org_slug / org_role / org_permissions claims instead of the packed o claim.

Clerk issues v2 claims now; this covers the still-supported older shape, and accepts permission strings in any form.

pub fn with_claim( self, name: impl Into<String>, value: impl Into<Value>, ) -> Self

Sets an arbitrary top-level claim, overriding anything above.

The escape hatch for claims this builder does not model — and for deliberately malformed tokens.

pub fn to_claims(&self) -> Result<Value, TestIssuerError>

The claim set this session serializes to.

Exposed so a test can assert on claims directly, or hand them to another signer.

Trait Implementations

impl Clone for TestSession

fn clone(&self) -> TestSession

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TestSession

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.