Struct ResolvedOAuthConfig 

#[non_exhaustive]
pub struct ResolvedOAuthConfig {

    pub issuer: String,
    pub jwks_uri: Option<String>,
    pub audience: String,
    pub audiences: Vec<String>,
    pub resource: String,
    pub required_scopes: Vec<String>,
    pub scopes_supported: Vec<String>,
    pub scope_claims: Vec<String>,
    pub principal_claims: Vec<String>,
    pub algorithms: Vec<Algorithm>,
    pub leeway_secs: u64,
    pub require_at_jwt: bool,
    pub allow_unscoped_tokens: bool,
    pub allow_insecure_http: bool,
    pub accept_static_bearer: bool,
    pub allowed_client_ids: Vec<String>,
    pub max_token_age_secs: Option<u64>,
    pub required_claims: BTreeMap<String, Value>,
    pub resource_name: Option<String>,
    pub key_naming: KeyNamingBuf,
}

The validated config an crate::OAuthValidator is built from.

Only OAuthConfig::resolve produces one with every invariant checked, so holding a ResolvedOAuthConfig (rather than an Option of one) IS the answer to “is OAuth on and usable” — nothing downstream re-checks a boolean. Fields are public so tests and applications can adjust a resolved value (the validator re-checks the invariants whose violation it could not survive: a non-empty audience set, a non-empty algorithm list, and leeway_secs within MAX_LEEWAY_SECS).

#[non_exhaustive]: outside this crate one comes from OAuthConfig::resolve (or, in tests, testing::resolved_config) and is then adjusted field by field, never built with a struct literal — which is what lets a new resolved setting be added without a breaking change.

Debug is hand-written and masks a credential in issuer, jwks_uri and resource the way OAuthConfig’s does.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

issuer: String

See OAuthConfig::issuer; byte-exact.

jwks_uri: Option<String>

None means “discover from the issuer’s metadata”. Never blank.

audience: String

The single audience; may be empty when audiences is not. Use ResolvedOAuthConfig::accepted_audiences for the effective set.

audiences: Vec<String>

See OAuthConfig::audiences.

resource: String

See OAuthConfig::resource.

required_scopes: Vec<String>

required_scope ∪ required_scopes: trimmed, deduplicated, in config order (required_scope first). A token must carry every one; empty means no scope check at all.

scopes_supported: Vec<String>

See OAuthConfig::scopes_supported; None there resolves to required_scopes. Advertised in the metadata document (omitted from it when empty) and in the 401 challenge.

scope_claims: Vec<String>

See OAuthConfig::scope_claims.

principal_claims: Vec<String>

See OAuthConfig::principal_claims.

algorithms: Vec<Algorithm>

Parsed and deduplicated. Algorithm has no HMAC or none variant, so this can never hold one.

leeway_secs: u64

See OAuthConfig::leeway_secs.

require_at_jwt: bool

See OAuthConfig::require_at_jwt.

allow_unscoped_tokens: bool

See OAuthConfig::allow_unscoped_tokens. Informational once resolved: resolve has already applied it.

allow_insecure_http: bool

See OAuthConfig::allow_insecure_http. resolve has already applied it to the configured URLs; the validator still reads it, for a discovered jwks_uri and for redirects followed while fetching keys.

accept_static_bearer: bool

See OAuthConfig::accept_static_bearer.

allowed_client_ids: Vec<String>

See OAuthConfig::allowed_client_ids; empty means no client check.

max_token_age_secs: Option<u64>

See OAuthConfig::max_token_age_secs; None means no age check.

required_claims: BTreeMap<String, Value>

See OAuthConfig::required_claims; empty means no claim check.

resource_name: Option<String>

Human-readable name published as resource_name in the RFC 9728 metadata document; omitted from it when None. Not a config key: OAuthConfig::resolve leaves it None, and an application that wants one sets it on the resolved value (it names the application, which the operator has no reason to change).

key_naming: KeyNamingBuf

How the validator’s log lines and errors name settings; what resolve was given.

Implementations

impl ResolvedOAuthConfig

pub fn accepted_audiences(&self) -> Vec<String>

audience ∪ audiences, blanks dropped, in config order.

Trait Implementations

impl Clone for ResolvedOAuthConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ResolvedOAuthConfig

Hand-written so a credential in a URL setting never reaches a log line through {:?}.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ResolvedOAuthConfig

impl PartialEq for ResolvedOAuthConfig

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ResolvedOAuthConfig