Struct JwtDecoder 

pub struct JwtDecoder { /* private fields */ }

JWT token decoder. Verifies signatures and validates claims.

All validation is synchronous — revocation checks happen in JwtLayer. Cloning is cheap — state is stored behind Arc.

Implementations

impl JwtDecoder

pub fn from_config(config: &JwtConfig) -> Self

Creates a JwtDecoder from YAML configuration.

Uses HmacSigner (HS256) with the configured secret.

pub fn decode<T: DeserializeOwned>(&self, token: &str) -> Result<Claims<T>>

Decodes and validates a JWT token string, returning typed Claims<T>.

Validation order:

1. Split into 3 parts (header.payload.signature)
2. Decode header, check algorithm matches the verifier
3. Verify HMAC signature
4. Decode and deserialize payload into Claims<T>
5. Enforce exp (always required; missing exp is treated as expired)
6. Check nbf (if present)
7. Check iss (if require_issuer is configured)
8. Check aud (if require_audience is configured)

Clock skew tolerance (leeway) is applied to steps 5 and 6.

Errors

Returns Error::unauthorized with a JwtError source for: malformed tokens, invalid headers, algorithm mismatch, invalid signatures, expired tokens, not-yet-valid tokens, issuer mismatch, or audience mismatch. Missing exp is treated as expired.

Trait Implementations

impl Clone for JwtDecoder

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl From<&JwtEncoder> for JwtDecoder

Creates a JwtDecoder that shares the signing key and validation config of an existing JwtEncoder. Useful when encoder and decoder are wired from the same JwtConfig value.

fn from(encoder: &JwtEncoder) -> Self

Converts to this type from the input type.