Struct AuditEvent 

pub struct AuditEvent {
    pub kind: VerifyErrorKind,
    pub occurred_at: OffsetDateTime,
    pub source_id: String,
    pub client_id_hint: Option<String>,
    pub kid_hint: Option<String>,
    pub metadata: BTreeMap<String, Value>,
}

Single typed event emitted on every BearerVerifier::verify rejection.

kind drives audit-pivot grouping; source_id drives rate-limiting and per-source dashboards; metadata carries free-form context (engine M-row identifier for Other, claim names, etc.).

Best-effort hint decoding: client_id_hint and kid_hint come from the rejected token’s payload/header via defensive base64+JSON parse. Either may be None if the token was malformed; callers MUST NOT treat absence as a security signal — by definition the token was rejected, so its claims are untrusted. The hints exist for grouping, not authentication.

source_id derivation: per Phase 9 design call (e), source_id is the compound client_id_hint ‖ kid_hint key. Anonymous / kid-less rejections collapse into a canonical "anon::nokid" bucket so attacker-controlled token mangling can’t explode the bucket count. See compose_source_id and AuditEvent::from_hints.

All fields are pub so adapters can serialize them or pivot on arbitrary subsets. The canonical construction path is AuditEvent::from_hints, which guarantees source_id matches the hints. Hand-constructing with mismatched values is technically possible (and useful for fault-injection in tests) but a code review concern in production.

Fields

kind: VerifyErrorKind

Failure classification — drives audit-pivot grouping.

occurred_at: OffsetDateTime

Wall-clock at engine reject (UTC, RFC 3339 wire format).

source_id: String

Compound client_id_hint ‖ kid_hint key for rate-limiting + per-source pivot.

client_id_hint: Option<String>

Best-effort client_id claim from the rejected token’s payload.

kid_hint: Option<String>

Best-effort kid from the rejected token’s header.

metadata: BTreeMap<String, Value>

Free-form structured context — engine M-row identifier for Other, claim names for telemetry, etc. BTreeMap (not HashMap) for deterministic ordering in snapshot tests.

Implementations

impl AuditEvent

pub fn from_hints( kind: VerifyErrorKind, occurred_at: OffsetDateTime, client_id_hint: Option<String>, kid_hint: Option<String>, metadata: BTreeMap<String, Value>, ) -> AuditEvent

Canonical constructor — composes source_id from the hints so the two never disagree. Production callers (Phase 9.D PasJwtVerifier::verify) use this.

pub fn from_id_token_hints( kind: VerifyErrorKind, occurred_at: OffsetDateTime, azp_hint: Option<String>, aud_hint: Option<String>, kid_hint: Option<String>, metadata: BTreeMap<String, Value>, ) -> AuditEvent

id_token-specific canonical constructor (Phase 10.11.D, δ2).

Composes the 3-tuple azp ‖ aud ‖ kid source key — strongest per-source discrimination for log-flood DoS prevention on the RP side. azp (when present) is the canonical “authorized party”; aud may be array (the engine surfaces only the first element to the hint pipeline); kid identifies the signing key.

Field repurpose: stores azp_hint in Self::client_id_hint (the SDK-shaped “authorized party” shares semantic with access-token’s client_id); pushes aud_hint into metadata under the key "aud_hint". Dashboard pivots on the access-token side use client_id_hint directly; id_token pivots use the same field plus the aud_hint metadata entry.

Production caller: [crate::oidc::PasIdTokenVerifier::emit_failure].

pub fn rate_limit_key(&self) -> RateLimitKey

Per-bucket rate-limit key. By default 1:1 with source_id. Composing once at construction keeps this O(1).

Trait Implementations

impl Clone for AuditEvent

fn clone(&self) -> AuditEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuditEvent

fn deserialize<__D>( __deserializer: __D, ) -> Result<AuditEvent, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuditEvent

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.