Struct Claims 

pub struct Claims {
    pub iss: Option<String>,
    pub sub: Option<String>,
    pub aud: Option<String>,
    pub exp: Option<u64>,
    pub nbf: Option<u64>,
    pub iat: Option<u64>,
    pub jti: Option<String>,
}

JWT claim payload used by the system auth flow.

Contains the seven registered JWT claims (iss, sub, aud, exp, nbf, iat, jti). All fields are optional — None values are omitted from the serialized token.

Custom auth flows that need extra payload fields should define their own struct and pass it directly to [JwtEncoder::encode<T>] / [JwtDecoder::decode<T>].

Example

use modo::auth::session::jwt::Claims;

let claims = Claims::new()
    .with_sub("user_123")
    .with_aud("my-app")
    .with_iat_now()
    .with_exp_in(std::time::Duration::from_secs(3600));

Fields

iss: Option<String>

Issuer (iss).

sub: Option<String>

Subject (sub) — typically the user identifier.

aud: Option<String>

Audience (aud).

exp: Option<u64>

Expiration time (exp) as a Unix timestamp in seconds.

nbf: Option<u64>

Not-before time (nbf) as a Unix timestamp in seconds.

iat: Option<u64>

Issued-at time (iat) as a Unix timestamp in seconds.

jti: Option<String>

JWT ID (jti) — unique identifier for the token.

Implementations

impl Claims

pub fn new() -> Self

Creates a new Claims with all registered fields set to None.

pub fn with_iss(self, iss: impl Into<String>) -> Self

Sets the issuer (iss) claim.

pub fn with_sub(self, sub: impl Into<String>) -> Self

Sets the subject (sub) claim.

pub fn with_aud(self, aud: impl Into<String>) -> Self

Sets the audience (aud) claim.

pub fn with_exp(self, exp: u64) -> Self

Sets the expiration time (exp) as an absolute Unix timestamp in seconds.

pub fn with_exp_in(self, duration: Duration) -> Self

Sets the expiration time (exp) relative to the current time.

pub fn with_nbf(self, nbf: u64) -> Self

Sets the not-before time (nbf) as an absolute Unix timestamp in seconds.

pub fn with_iat_now(self) -> Self

Sets the issued-at time (iat) to the current time.

pub fn with_jti(self, jti: impl Into<String>) -> Self

Sets the JWT ID (jti).

pub fn is_expired(&self) -> bool

Returns true if the token has an exp claim that is in the past. Returns false when exp is absent.

pub fn is_not_yet_valid(&self) -> bool

Returns true if the token has an nbf claim that is in the future. Returns false when nbf is absent.

pub fn subject(&self) -> Option<&str>

Returns the subject claim (sub) as a string slice, if present.

pub fn token_id(&self) -> Option<&str>

Returns the JWT ID (jti) as a string slice, if present.

pub fn issuer(&self) -> Option<&str>

Returns the issuer claim (iss) as a string slice, if present.

pub fn audience(&self) -> Option<&str>

Returns the audience claim (aud) as a string slice, if present.

Trait Implementations

impl Clone for Claims

fn clone(&self) -> Claims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Claims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Claims

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Claims

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<S: Send + Sync> FromRequestParts<S> for Claims

Extracts Claims from request extensions.

JwtLayer must be applied to the route — the middleware decodes the token and inserts Claims into extensions before the handler is called. Returns 401 Unauthorized when claims are not present in extensions.

type Rejection = Error

If the extractor fails it’ll use this “rejection” type. A rejection is a kind of error that can be converted into a response.

async fn from_request_parts( parts: &mut Parts, _state: &S, ) -> Result<Self, Self::Rejection>

Perform the extraction.

impl<S: Send + Sync> OptionalFromRequestParts<S> for Claims

Optionally extracts Claims from request extensions.

Returns Ok(None) when JwtLayer is not applied or the token is missing/invalid, allowing routes to serve both authenticated and unauthenticated users.

type Rejection = Error

If the extractor fails, it will use this “rejection” type.

async fn from_request_parts( parts: &mut Parts, _state: &S, ) -> Result<Option<Self>, Self::Rejection>

Perform the extraction.

impl Serialize for Claims

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.