Struct ProtectedResourceConfig 

#[non_exhaustive]
pub struct ProtectedResourceConfig {

    pub resource: String,
    pub authorization_servers: Vec<String>,
    pub jwks_uri: Option<String>,
    pub scopes_supported: Option<Vec<String>>,
    pub bearer_methods_supported: Vec<BearerMethod>,
    pub resource_signing_alg_values_supported: Vec<String>,
    pub resource_name: Option<String>,
    pub resource_documentation: Option<String>,
    pub resource_policy_uri: Option<String>,
    pub resource_tos_uri: Option<String>,
    pub tls_client_certificate_bound_access_tokens: bool,
    pub dpop_bound_access_tokens_required: bool,
    pub dpop_signing_alg_values_supported: Vec<String>,
    pub authorization_details_types_supported: Vec<String>,
    pub signed_metadata: Option<String>,
}

Available on crate feature resource-metadata only.

What a host declares about its own protected resource, from which ProtectedResourceMetadata::from_config derives the document.

Only two things have no sane default and are therefore arguments to ProtectedResourceConfig::new: the resource identifier (section 2 makes resource REQUIRED), and the issuer identifier of at least one authorization server, without which the document tells a client nothing it can act on. #[non_exhaustive]: RFC 9728 section 7.1 registers these members in an IANA registry that takes new entries, and this type gains a field for each one this crate learns to publish. A host that wrote a full struct literal would have a build that breaks on a PATCH release that only added a member. Construct with new() and assign the fields you want. This is the one attribute on this type that cannot be added after publication, because by then somebody’s struct literal is in production.

Note that the justification is NOT the one crate::metadata::AuthorizationServerMetadata carries: that type’s field set genuinely varies with cargo features, and this one’s does not — there is no #[cfg] on any field here, because RFC 9728 is the whole of the resource-metadata feature and nothing else gates a member of it. Both types want the attribute; they want it for different reasons, and stating the wrong one invites somebody to remove the attribute on discovering the reason is untrue.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

resource: String

Section 2 resource: the resource identifier, an absolute URI with no fragment. This is the SAME string a client sends as an RFC 8707 resource indicator to get a token for this resource, and the same string section 3.3 requires the served document to echo.

authorization_servers: Vec<String>

Section 2 authorization_servers: the issuer identifiers of the ASes that can issue tokens for this resource. Empty omits the member rather than publishing an empty array, which would say “no authorization server can issue for me”.

jwks_uri: Option<String>

Section 2 jwks_uri: the RESOURCE’s own key set, for signed resource responses. This is NOT the authorization server’s jwks_uri and must not be set to it: section 2 defines it as the keys a client uses to validate signatures FROM this resource, and pointing it at the AS would tell clients to validate resource responses with token-signing keys.

scopes_supported: Option<Vec<String>>

Section 2 scopes_supported (RECOMMENDED): the scope values used with this resource. None omits the member; an empty catalogue and an undeclared one are different claims.

bearer_methods_supported: Vec<BearerMethod>

Section 2 bearer_methods_supported. Empty omits the member, which section 2 leaves as “unspecified” rather than “none”.

resource_signing_alg_values_supported: Vec<String>

Section 2 resource_signing_alg_values_supported: JWS alg values this resource signs its RESPONSES with. Empty omits the member. none is not a value this crate will emit, for the reason RFC 7518 section 3.6 gives.

resource_name: Option<String>

Section 2.1 resource_name (RECOMMENDED): a human-readable name for display to end users.

resource_documentation: Option<String>

Section 2 resource_documentation: a page of developer documentation.

resource_policy_uri: Option<String>

Section 2 resource_policy_uri: how the resource’s data is used.

resource_tos_uri: Option<String>

Section 2 resource_tos_uri: terms of service.

tls_client_certificate_bound_access_tokens: bool

Section 2 tls_client_certificate_bound_access_tokens (RFC 8705): whether this resource supports mutual-TLS certificate-bound access tokens. false OMITS the member rather than publishing false, because section 2 gives false as the default when absent and a host that never thought about mTLS should not be made to publish a sentence about it.

dpop_bound_access_tokens_required: bool

Section 2 dpop_bound_access_tokens_required (RFC 9449): whether this resource ALWAYS requires DPoP-bound tokens. Same omit-on-false rule and same reason.

dpop_signing_alg_values_supported: Vec<String>

Section 2 dpop_signing_alg_values_supported: JWS alg values accepted in a DPoP proof. Empty omits the member.

authorization_details_types_supported: Vec<String>

Section 2 authorization_details_types_supported (RFC 9396): the RAR type values this resource understands. Empty omits the member.

signed_metadata: Option<String>

Section 2.2 signed_metadata: a JWT whose claims are these same members, signed by the resource.

This crate does NOT produce it, and will not silently: signing requires a key this crate does not hold (the RESOURCE’s key, not the AS’s), and section 7.9 makes the signed and unsigned documents carry different trust, so manufacturing one here would be the AS asserting something about a resource on the resource’s behalf. A host that signs its own document sets the compact serialization here and this crate passes it through unread.

Implementations

impl ProtectedResourceConfig

pub fn new( resource: impl Into<String>, authorization_server: impl Into<String>, ) -> Self

A config for resource, protected by the authorization server at issuer identifier authorization_server.

Defaults chosen so that the document a host publishes without touching anything else is both minimal and true: header-only bearer presentation (RFC 6750 section 2.1, the one form OAuth 2.1 keeps), and no capability claimed that the host has not stated.

Trait Implementations

impl Clone for ProtectedResourceConfig

fn clone(&self) -> ProtectedResourceConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProtectedResourceConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ProtectedResourceConfig

impl PartialEq for ProtectedResourceConfig

fn eq(&self, other: &ProtectedResourceConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ProtectedResourceConfig