pub struct JwtLayer { /* private fields */ }Expand description
Tower Layer that installs JWT authentication on a route.
For each request the middleware:
- Tries each
TokenSourcein order; returns401if none yields a token. - Decodes and validates the token with
JwtDecoder; returns401on failure. - Inserts
Claimsinto request extensions for handler extraction. - When constructed via
JwtLayer::from_service, also performs a stateful database row lookup: hashes thejticlaim and reads the session row, inserting the transport-agnosticSessioninto extensions. Returns401if the row is missing (logged-out / revoked).
The default token source is BearerSource (Authorization: Bearer <token>).
Implementations§
Source§impl JwtLayer
impl JwtLayer
Sourcepub fn new(decoder: JwtDecoder) -> Self
pub fn new(decoder: JwtDecoder) -> Self
Creates a JwtLayer with BearerSource as the sole token source.
This constructor performs stateless JWT validation only (signature +
claims). No database row lookup is performed. Use JwtLayer::from_service
for stateful validation that also inserts Session
into request extensions.
Sourcepub fn from_service(service: JwtSessionService) -> Self
pub fn from_service(service: JwtSessionService) -> Self
Creates a JwtLayer backed by a JwtSessionService.
After JWT signature/claims validation the middleware hashes the jti
claim, looks up the session row in the database, and inserts the
transport-agnostic Session into
request extensions. Returns 401 with auth:session_not_found when
the session row is absent (logged-out or revoked).
Use JwtSessionService::layer as the primary entry-point; this
constructor is the lower-level building block.
Sourcepub fn with_sources(self, sources: Vec<Arc<dyn TokenSource>>) -> Self
pub fn with_sources(self, sources: Vec<Arc<dyn TokenSource>>) -> Self
Replaces the token sources with the provided list.
Sources are tried in order; the first to return Some is used.