Struct PasIdTokenVerifier 

pub struct PasIdTokenVerifier<S: ScopePiiReader> { /* private fields */ }

Re-export of the production id_token verifier adapter. PAS OIDC id_token verifier (RFC 9068 + OIDC Core 1.0, EdDSA).

Constructed once per consumer deployment with the JWKS URL and the per-deployment VerifyConfig. Cheap to clone — internal state is Arc-shared, so you can store the verifier behind Arc<dyn IdTokenVerifier<S>> in a request extension or per-route layer without measurable overhead.

JwksCache and ArcClock have no useful Debug representation, so this is a manual impl that surfaces only the expectations shape.

As of 0.8.0 the containing oidc::verifier module is pub(crate). Production consumers reach the verify-half through super::RelyingParty<S>::complete, which constructs and consumes this verifier internally. SDK boundary tests + downstream consumer integration tests reach the type via the crate::test_support::PasIdTokenVerifier re-export under the test-support feature gate.

Implementations

impl<S: ScopePiiReader> PasIdTokenVerifier<S>

pub async fn from_jwks_url( jwks_url: impl Into<String>, expectations: VerifyConfig, ) -> Result<Self, IdVerifyError>

Single textbook constructor — mirror of PasJwtVerifier::from_jwks_url. Performs an initial JWKS fetch + cache; subsequent verifications snapshot the cache, refreshing on TTL expiry.

Errors

Returns IdVerifyError::KeysetUnavailable if the initial JWKS fetch fails. The verifier cannot serve verifications without at least one usable key snapshot.

pub fn for_test_skip_fetch(expectations: VerifyConfig) -> Self

Test-support ctor — constructs a verifier without performing a JWKS fetch. Mirror of PasJwtVerifier::for_test_skip_fetch.

The internal keyset is empty, so any engine verify path rejects on KidUnknown (mapped to IdVerifyError::SignatureInvalid per [map_auth_error]). Adapter-side rejection paths (IdVerifyError::InvalidFormat) are fully exercisable since they reject before consulting the keyset.

Used by Phase 10.11.E’s boundary tests to drive the verify path without a wiremock-shaped JWKS endpoint. NOT for production use — use Self::from_jwks_url instead.

Trait Implementations

impl<S: Clone + ScopePiiReader> Clone for PasIdTokenVerifier<S>

fn clone(&self) -> PasIdTokenVerifier<S>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S: ScopePiiReader> Debug for PasIdTokenVerifier<S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S: ScopePiiReader> IdTokenVerifier<S> for PasIdTokenVerifier<S>

fn verify<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, id_token: &'life1 str, expected_nonce: &'life2 Nonce, ) -> Pin<Box<dyn Future<Output = Result<IdAssertion<S>, IdVerifyError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,