Struct ProtectedResourceMetadata 

#[non_exhaustive]
pub struct ProtectedResourceMetadata {

    pub resource: String,
    pub authorization_servers: Option<Vec<String>>,
    pub jwks_uri: Option<String>,
    pub scopes_supported: Option<Vec<String>>,
    pub bearer_methods_supported: Option<Vec<BearerMethod>>,
    pub resource_signing_alg_values_supported: Option<Vec<String>>,
    pub resource_name: Option<String>,
    pub resource_documentation: Option<String>,
    pub resource_policy_uri: Option<String>,
    pub resource_tos_uri: Option<String>,
    pub tls_client_certificate_bound_access_tokens: Option<bool>,
    pub authorization_details_types_supported: Option<Vec<String>>,
    pub dpop_signing_alg_values_supported: Option<Vec<String>>,
    pub dpop_bound_access_tokens_required: Option<bool>,
    pub signed_metadata: Option<String>,
}

Available on crate feature resource-metadata only.

An RFC 9728 protected resource metadata document.

Published by the RESOURCE, at well_known_path under the resource’s own origin. See the module docs for why this crate carries the type but does not serve it.

Optional members are Option and are OMITTED when absent, never serialized as null, exactly as crate::metadata::AuthorizationServerMetadata does and for the same reason: section 2 defines member types, and null is not one of them.

#[non_exhaustive] for the same reason ProtectedResourceConfig is, and it is the DOCUMENT that the reason is really about: RFC 9728 section 7.1 registers its members in an IANA registry that takes new entries, so this type gains a field whenever the crate learns to publish one, and a member added to a wire format is not a breaking change to anybody except a host who wrote the struct out by hand. The supported way to build one is ProtectedResourceMetadata::from_config, which is also the only way to get a document that agrees with the ProtectedResourceConfig the host actually declared. Deserialize is derived and is unaffected, so a client-side or test-side consumer parsing a served document still works, and so does reading or matching on any field.

Added in 0.9.1, which is the last release it can be added in: 0.9.0 was an alpha published so the crate could be built against, and after a release meant for real use the attribute can never go on, because by then somebody’s struct literal is in production.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

resource: String

REQUIRED (section 2). Section 3.3 makes this the member a client checks: it MUST be identical to the resource identifier the well-known suffix was inserted into, or the document MUST NOT be used.

authorization_servers: Option<Vec<String>>

OPTIONAL (section 2). Issuer identifiers, each of which a client then discovers through RFC 8414. Section 7.6: this is the RESOURCE’s claim, so a client is expected to be suspicious of it rather than to follow it blindly.

jwks_uri: Option<String>

OPTIONAL (section 2). The RESOURCE’s key set, not the AS’s.

scopes_supported: Option<Vec<String>>

RECOMMENDED (section 2). Section 7.2: publishing scopes is what lets a client ask for the least it needs rather than the most it can.

bearer_methods_supported: Option<Vec<BearerMethod>>

OPTIONAL (section 2).

resource_signing_alg_values_supported: Option<Vec<String>>

OPTIONAL (section 2). JWS alg values for signed responses FROM this resource.

resource_name: Option<String>

RECOMMENDED (section 2.1). Human-readable, for display to end users.

resource_documentation: Option<String>

OPTIONAL (section 2).

resource_policy_uri: Option<String>

OPTIONAL (section 2).

resource_tos_uri: Option<String>

OPTIONAL (section 2).

tls_client_certificate_bound_access_tokens: Option<bool>

OPTIONAL (section 2), RFC 8705. Omitted rather than false, since section 2 already gives false as the default when the member is absent.

authorization_details_types_supported: Option<Vec<String>>

OPTIONAL (section 2), RFC 9396.

dpop_signing_alg_values_supported: Option<Vec<String>>

OPTIONAL (section 2), RFC 9449.

dpop_bound_access_tokens_required: Option<bool>

OPTIONAL (section 2), RFC 9449. Omitted rather than false, as above.

signed_metadata: Option<String>

OPTIONAL (section 2.2). Passed through from the host; never produced by this crate.

Implementations

impl ProtectedResourceMetadata

pub fn from_config(config: &ProtectedResourceConfig) -> Self

Derive the document from the resource’s configuration.

pub fn well_known_path(&self) -> String

Where this document belongs, as an absolute path from the resource origin’s root. See well_known_path, which this defers to so the served location and the resource member cannot drift apart.

Trait Implementations

impl Clone for ProtectedResourceMetadata

fn clone(&self) -> ProtectedResourceMetadata

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProtectedResourceMetadata

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProtectedResourceMetadata

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ProtectedResourceMetadata

impl PartialEq for ProtectedResourceMetadata

fn eq(&self, other: &ProtectedResourceMetadata) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ProtectedResourceMetadata

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ProtectedResourceMetadata