Struct Claims 

pub struct Claims {
    pub sub: String,
    pub iat: u64,
    pub exp: u64,
    pub nbf: Option<u64>,
    pub iss: String,
    pub aud: Vec<String>,
    pub extra: HashMap<String, Value>,
}

Standard JWT claims with support for custom claims

Fields

sub: String

Subject (typically user ID)

iat: u64

Issued at (Unix timestamp)

exp: u64

Expiration time (Unix timestamp)

nbf: Option<u64>

Not-before time (Unix timestamp) — optional per RFC 7519 §4.1.5.

When present, the token MUST NOT be accepted before this time (plus MAX_CLOCK_SKEW_SECS). When absent, the not-before check is skipped.

iss: String

Issuer

aud: Vec<String>

Audience

extra: HashMap<String, Value>

Additional custom claims

Implementations

impl Claims

pub fn get_custom(&self, key: &str) -> Option<&Value>

Get a custom claim by name

pub fn email(&self) -> Option<String>

Extract the email claim as a flat string.

Handles plain strings, nested objects ({"value": "..."}, {"email": "..."}), and arrays (first string element). Returns None when the claim is absent, null, or cannot be normalised to a non-empty string.

pub fn name(&self) -> Option<String>

Extract the name claim as a flat display-name string.

In addition to the shapes handled by extract_claim_string, this also concatenates given + family keys when the claim is an object without a formatted or value key. Returns None when the claim is absent or cannot be normalised.

pub fn is_expired(&self) -> bool

Check if token is expired

SECURITY: If system time cannot be determined, returns true (treats token as expired) This is a fail-safe approach to prevent accepting tokens when we can’t verify expiry

pub fn validate_temporal_claims(&self) -> Result<()>

Validate temporal claims: iat staleness/skew and nbf not-before.

Enforces three RFC 7519 temporal guards beyond exp:

• iat must not be more than MAX_CLOCK_SKEW_SECS seconds in the future (forgery guard — a future iat is implausible for a legitimately issued token).
• iat must not be more than MAX_TOKEN_AGE_SECS seconds in the past (replay guard — a stale iat indicates a replayed or abnormally long-lived token).
• nbf (if present) must not be more than MAX_CLOCK_SKEW_SECS seconds in the future (RFC 7519 §4.1.5 not-before enforcement).

Errors

• AuthError::TokenIssuedInFuture if iat > now + MAX_CLOCK_SKEW_SECS.
• AuthError::TokenTooOld if now - iat > MAX_TOKEN_AGE_SECS.
• AuthError::TokenNotYetValid if nbf > now + MAX_CLOCK_SKEW_SECS.
• AuthError::SystemTimeError if the system clock cannot be read.

Trait Implementations

impl Clone for Claims

fn clone(&self) -> Claims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Claims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Claims

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Claims

fn eq(&self, other: &Claims) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Claims

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for Claims

impl StructuralPartialEq for Claims