Struct TokenResponse 

#[non_exhaustive]
pub struct TokenResponse {
    pub access_token: String,
    pub token_type: TokenType,
    pub expires_in: u64,
    pub refresh_token: Option<String>,
    pub scope: Option<String>,
    pub authorization_details: AuthorizationDetails,
}

The RFC 6749 section 5.1 successful token response.

Debug is hand-written (see below) rather than derived: access_token and refresh_token are bearer credentials (RFC 6750 section 1 for the access token; RFC 9700 section 4.14.2 for the refresh token), so a host doing the obvious tracing::debug!(?response) must not thereby write either to its logs. #[non_exhaustive]: authorization_details appears only under the rar feature, so this struct’s field set moves with a flag no host controls alone. This is an OUTPUT: the crate builds it and the host serializes it, so the paths that matter are unaffected, and a host that needs to build one anyway (a proxy, a test double) still has Deserialize, which is derived in here and so keeps working from outside.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

access_token: String

The access token: an opaque random string, or an RFC 9068 JWT under the jwt feature.

token_type: TokenType

Bearer (RFC 6750), or DPoP (RFC 9449 s5) when the dpop feature is on and the token request carried a proof, because a sender-constrained token MUST NOT be presented as a bearer token.

expires_in: u64

Lifetime in seconds (RECOMMENDED by the RFC; this server always includes it).

refresh_token: Option<String>

The rotating refresh token, when the grant and server config produce one.

scope: Option<String>

Space-delimited granted scope. This server always includes it when non-empty, which also satisfies the section 3.3 requirement to report a scope differing from the request.

authorization_details: AuthorizationDetails

Available on crate feature rar only.

The RFC 9396 authorization details as GRANTED, which section 7 makes a MUST for a response to a request that carried them.

It is a MUST for the same reason RFC 6749 section 3.3 has scope echoed when it differs from the request: section 7.1 explicitly permits what was granted to differ from what was asked for, because the host’s consent screen may narrow or enrich it. Without this member a client has no way to learn that what it holds is not what it requested, and would go on to call a resource server believing it can do something it cannot.

Omitted entirely when empty, so a deployment that never uses authorization details emits exactly the body it emitted before this existed.

#[serde(default)] is what makes that omission READABLE, and it is not optional beside a skip_serializing_if. The two together are a matched pair: a member left out on the way out has to be allowed to be absent on the way back in, or the type cannot parse the very body it just emitted. Without it the ordinary response above is refused with missing field "authorization_details", which also falsifies the #[non_exhaustive] note above promising a host that Deserialize “keeps working from outside”: a proxy or a test double reading a response back would break the moment rar appeared anywhere in its dependency graph.

Trait Implementations

impl Clone for TokenResponse

fn clone(&self) -> TokenResponse

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenResponse

Hand-written so neither access_token nor refresh_token ever prints. refresh_token keeps its Some/None shape (via redact_opt, mirrored from crate::server::TokenRequest’s hand-written Debug): whether a refresh token was issued at all is diagnostic, not secret, and collapsing Some("[redacted]") and None to the same output would hide that.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TokenResponse

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for TokenResponse

impl PartialEq for TokenResponse

fn eq(&self, other: &TokenResponse) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for TokenResponse

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for TokenResponse