Struct AuthGuard 

pub struct AuthGuard {
    pub claims: Claims,
    /* private fields */
}

Extractor: pulls the authenticated user from the request

Usage in a handler:

async fn my_handler(user: AuthGuard) -> impl IntoResponse {
    format!("Hello {}", user.claims.username)
}

Fields

claims: Claims

Implementations

impl AuthGuard

pub fn from_claims(claims: Claims) -> Self

Build an AuthGuard from existing Claims (e.g. for refresh token validation)

pub fn has_role(&self, role: &str) -> bool

Check if the user has a specific role (with hierarchy resolution). E.g. a ROLE_SUPER_ADMIN user will pass has_role("ROLE_ADMIN").

pub fn require_role(&self, role: &str) -> Result<(), AppError>

Require a specific role, return Forbidden if not

pub fn sub(&self) -> &str

Get the subject (sub claim — usually email or string user ID)

pub fn user_id(&self) -> Option<i64>

Get the numeric user ID (if set in token)

pub fn user_uuid(&self) -> Option<&str>

Get the user UUID (if set in token)

pub fn username(&self) -> &str

Get the username

Trait Implementations

impl Clone for AuthGuard

fn clone(&self) -> AuthGuard

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthGuard

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl FromRequestParts<AppState> for AuthGuard

type Rejection = AppError

If the extractor fails it’ll use this “rejection” type. A rejection is a kind of error that can be converted into a response.

async fn from_request_parts( parts: &mut Parts, state: &AppState, ) -> Result<Self, Self::Rejection>

Perform the extraction.