Struct TokenBuilder 

pub struct TokenBuilder { /* private fields */ }

Available on crate feature testing only.

A fluent builder for a signed JWT access token, from TestAuthority::token. Every method changes one thing about the token, so a test states exactly what is wrong (or different) about it; the defaults are documented on TestAuthority::token.

Time setters are relative to now and in seconds (expires_in, expired, not_before_in, issued_ago). For an absolute or odd value use claim: .claim("nbf", 4102444800_u64), .claim("exp", "soon").

Claim-shaping calls apply in this order: the fields above (iss, aud, sub, scope, exp, iat, nbf), then claim overrides, then without_claim removals, so without_claim("exp") really produces a token with no exp.

Examples

use oauth_resource_server::Algorithm;
use oauth_resource_server::testing::TestAuthority;

let authority = TestAuthority::start().await;
let jwt = authority
    .token()
    .subject("ada")
    .scopes(["api:read", "api:write"])
    .audience("https://other.example.test/")
    .expires_in(60)
    .typ("at+jwt")
    .alg(Algorithm::ES256)
    .claim("groups", ["admins"])
    .sign();
assert_eq!(jwt.split('.').count(), 3);

Implementations

impl TokenBuilder

pub fn subject(self, subject: impl Into<String>) -> Self

Set sub.

pub fn scopes<I, S>(self, scopes: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Replace the scopes, carried in the space-delimited scope claim. An empty list omits the claim.

pub fn audience(self, audience: impl Into<String>) -> Self

Set aud to this one audience (a JSON string).

pub fn audiences<I, S>(self, audiences: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

Set aud to these audiences (a JSON array, or a string when there is exactly one).

pub fn issuer(self, issuer: impl Into<String>) -> Self

Override iss (default: the authority’s issuer), for a wrong-issuer test.

pub fn expires_in(self, secs: u64) -> Self

Make the token expire secs seconds from now.

pub fn expired(self) -> Self

Make the token expired: exp an hour in the past, well beyond the default 60-second leeway.

pub fn not_before_in(self, secs: u64) -> Self

Set nbf to secs seconds in the future, so the token is not yet valid (mind the default 60-second leeway).

pub fn issued_ago(self, secs: u64) -> Self

Set iat to secs seconds in the past (default: now).

pub fn typ(self, typ: impl Into<String>) -> Self

Set the JOSE header typ (default at+jwt, RFC 9068).

pub fn without_typ(self) -> Self

Omit the JOSE header typ entirely.

pub fn alg(self, alg: Algorithm) -> Self

Sign with alg (default Algorithm::RS256), using the matching throwaway key: the active RSA key for RS*/PS*, the P-256 key for ES256, the Ed25519 key for EdDSA. All of them are published by the authority, each under its own kid. The header kid follows unless kid overrides it. ES384 has no throwaway key: sign panics for it.

pub fn kid(self, kid: impl Into<String>) -> Self

Set the header kid, overriding the one that names the signing key (for an unknown-kid or “signed by one key, labelled as another” test).

pub fn claim(self, name: impl Into<String>, value: impl Serialize) -> Self

Set (or override) one claim, any JSON-serializable value. This is also how to set an absolute or malformed exp/nbf/iat.

Panics

If value fails to serialize.

pub fn without_claim(self, name: impl Into<String>) -> Self

Leave a claim out of the token, including a default one such as exp, aud or iss.

pub fn sign(self) -> String

Sign the token and return the compact JWT.

Panics

If alg is an algorithm with no throwaway key (ES384).

Trait Implementations

impl Clone for TokenBuilder

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenBuilder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.