Struct JwtDecoder 

pub struct JwtDecoder { /* private fields */ }

JWT token decoder. Verifies signatures and validates claims.

All validation is synchronous. Cloning is cheap — state is stored behind Arc.

Implementations

impl JwtDecoder

pub fn new( verifier: Arc<dyn TokenVerifier>, validation: ValidationConfig, ) -> Self

Creates a JwtDecoder with an explicit verifier and validation policy.

Use this constructor when you need full control over the validation config, e.g. to set require_audience or leeway.

Example

use std::sync::Arc;
use modo::auth::session::jwt::{HmacSigner, JwtDecoder, ValidationConfig};

let signer = HmacSigner::new(b"my-secret");
let validation = ValidationConfig {
    require_audience: Some("my-app".into()),
    ..ValidationConfig::default()
};
let decoder = JwtDecoder::new(Arc::new(signer), validation);

pub fn from_config(config: &JwtSessionsConfig) -> Self

Creates a JwtDecoder from YAML configuration.

Uses HmacSigner (HS256) with the configured secret.

pub fn decode<T: DeserializeOwned>(&self, token: &str) -> Result<T>

Decodes and validates a JWT token string, returning T.

The system auth flow passes Claims as T and gets a Claims back. Custom auth flows can pass any DeserializeOwned struct directly.

Validation order:

1. Split into 3 parts (header.payload.signature)
2. Decode header, check algorithm matches the verifier
3. Verify HMAC signature
4. Decode payload into JSON value
5. Enforce exp (always required; missing exp is treated as expired)
6. Check nbf (if present)
7. Check iss (if require_issuer is configured)
8. Check aud (if require_audience is configured)
9. Deserialize validated JSON value into T

Clock skew tolerance (leeway) is applied to steps 5 and 6.

Errors

Returns Error::unauthorized with a JwtError source for: malformed tokens, invalid headers, algorithm mismatch, invalid signatures, expired tokens, not-yet-valid tokens, issuer mismatch, or audience mismatch. Missing exp is treated as expired.

Trait Implementations

impl Clone for JwtDecoder

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl From<&JwtEncoder> for JwtDecoder

Creates a JwtDecoder that shares the signing key and validation config of an existing JwtEncoder. Useful when encoder and decoder are wired from the same JwtConfig value.

fn from(encoder: &JwtEncoder) -> Self

Converts to this type from the input type.