Struct VerifyIdTokenLayer 

pub struct VerifyIdTokenLayer { /* private fields */ }

A tower layer that lets a request through only with a valid Google ID token in its authorization: Bearer header, and puts the token’s claims into the request’s extensions for the VerifiedIdToken extractor.

Requests it refuses never reach the inner service. They get an empty response:

• 401 with www-authenticate: Bearer when there is no bearer token;
• 401 with www-authenticate: Bearer error="invalid_token" when the token does not verify;
• 503 when the signing keys cannot be fetched;
• 403 when the token verifies but authorize refuses it.

Implementations

impl VerifyIdTokenLayer

pub fn new(verifier: Arc<IdTokenVerifier>) -> Self

A layer that admits every token verifier accepts.

pub fn authorize( self, authorize: impl Fn(&VerifiedIdToken) -> bool + Send + Sync + 'static, ) -> Self

Admits only the verified tokens for which authorize returns true, such as those of an allowlist of callers; the others get 403. Replaces any earlier authorize.

Trait Implementations

impl Clone for VerifyIdTokenLayer

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S> Layer<S> for VerifyIdTokenLayer

type Service = VerifyIdToken<S>

The wrapped service

fn layer(&self, inner: S) -> Self::Service

Wrap the given service with the middleware, returning a new service that has been decorated with the middleware.