Struct Claims 

pub struct Claims { /* private fields */ }

Standard OIDC claims decoded from an ID token.

JWT signature validation is optional but strongly encouraged. Configure a crate::jwks::JwksValidator via the builder to enable cryptographic validation of the ID token.

Examples

Accessing claims:

use loopauth::oidc::Claims;
use std::time::UNIX_EPOCH;
use url::Url;

let json = serde_json::json!({
    "sub": "user123",
    "email": "user@example.com",
    "email_verified": true,
    "name": "Test User",
    "picture": "https://example.com/avatar.jpg",
    "iss": "https://accounts.example.com",
    "aud": ["client-id"],
    "iat": 1_000_000_000_u64,
    "exp": 9_999_999_999_u64
});
let claims: Claims = serde_json::from_value(json).unwrap();

assert_eq!(claims.sub().as_str(), "user123");
assert_eq!(claims.email().unwrap().as_str(), "user@example.com");
assert!(claims.email().unwrap().is_verified());
assert_eq!(claims.name(), Some("Test User"));
assert_eq!(claims.picture().unwrap().as_url().as_str(), "https://example.com/avatar.jpg");
assert_eq!(claims.iss().as_url(), &Url::parse("https://accounts.example.com").unwrap());
assert_eq!(claims.aud().len(), 1);
assert!(claims.iat() > UNIX_EPOCH);
assert!(claims.exp() > UNIX_EPOCH);

Serde roundtrip preserves all fields including email_verified and picture:

use loopauth::oidc::Claims;

let original = serde_json::json!({
    "sub": "user123",
    "email": "user@example.com",
    "email_verified": true,
    "name": "Test User",
    "picture": "https://example.com/avatar.jpg",
    "iss": "https://accounts.example.com",
    "aud": ["client-id"],
    "iat": 1_000_000_000_u64,
    "exp": 9_999_999_999_u64
});
let claims: Claims = serde_json::from_value(original).unwrap();
let serialized = serde_json::to_string(&claims).unwrap();
let roundtripped: Claims = serde_json::from_str(&serialized).unwrap();

assert_eq!(roundtripped.email().unwrap().as_str(), "user@example.com");
assert!(roundtripped.email().unwrap().is_verified());
assert_eq!(roundtripped.picture().unwrap().as_url().as_str(), "https://example.com/avatar.jpg");

Implementations

impl Claims

pub const fn sub(&self) -> &SubjectIdentifier

Returns the subject identifier.

pub const fn email(&self) -> Option<&Email>

Returns the email address, if present.

pub fn name(&self) -> Option<&str>

Returns the display name, if present.

pub const fn picture(&self) -> Option<&PictureUrl>

Returns the picture URL, if present.

pub const fn iss(&self) -> &Issuer

Returns the issuer identifier.

pub fn aud(&self) -> &[Audience]

Returns the audience values.

pub fn aud_contains(&self, client_id: &str) -> bool

Returns true if client_id appears in the aud claim.

Example

use loopauth::oidc;

let json = serde_json::json!({
    "sub": "user123",
    "iss": "https://accounts.example.com",
    "aud": ["my-client-id"],
    "iat": 1_000_000_000_u64,
    "exp": 9_999_999_999_u64
});
let claims: oidc::Claims = serde_json::from_value(json).unwrap();
assert!(claims.aud_contains("my-client-id"));
assert!(!claims.aud_contains("other-client"));

pub const fn iat(&self) -> SystemTime

Returns the time at which the ID token was issued.

pub const fn exp(&self) -> SystemTime

Returns the expiration time of the ID token.

pub fn is_expired(&self) -> bool

Returns true if the ID token’s exp claim is more than 60 seconds in the past.

A 60-second clock-skew window is applied to match the tolerance used during ID token validation. Tokens that expired less than 60 seconds ago are still considered valid.

Trait Implementations

impl Clone for Claims

fn clone(&self) -> Claims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Claims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Claims

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Claims

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.