ppoppo_sdk_core/verifier/
config.rs

1//! `VerifyConfig` — per-deployment verification expectations.
2//!
3//! Phase A audit decision G renamed `Expectations` → `VerifyConfig` to
4//! disambiguate from the consumer-side `AuthSession` types and to use
5//! a name closer to the engine's `ppoppo_token::access_token::VerifyConfig`.
6
7/// Per-deployment expectations folded into the verifier at construction.
8///
9/// `issuer` is the PAS instance URL (`accounts.ppoppo.com` in
10/// production); `audience` is the consumer's OAuth `client_id`. Both
11/// are static per-deployment — multi-tenant consumers instantiate
12/// multiple verifiers, never rotate `VerifyConfig` on the per-call hot
13/// path.
14///
15/// Held inside [`super::JwtVerifier`] (and optionally inside
16/// [`super::MemoryBearerVerifier`]) so the
17/// [`super::BearerVerifier::verify`] signature stays one-parameter —
18/// the port is as small as it can be while still doing meaningful work.
19#[derive(Debug, Clone)]
20pub struct VerifyConfig {
21    pub issuer: String,
22    pub audience: String,
23}
24
25impl VerifyConfig {
26    /// Construct from owned strings. Consumer wiring typically reads
27    /// these from environment variables at startup.
28    #[must_use]
29    pub fn new(issuer: impl Into<String>, audience: impl Into<String>) -> Self {
30        Self {
31            issuer: issuer.into(),
32            audience: audience.into(),
33        }
34    }
35}
ppoppo_sdk_core/verifier/config.rs

ppoppo_sdk_core/verifier/
config.rs
