Struct TokenClaims 

pub struct TokenClaims { /* private fields */ }

What an adapter established about a presented token, before this crate’s own rules ran.

“Established” means the adapter verified the signature (JWT) or asked the authorization server (introspection). It is deliberately not a type that can be built from a raw string in this crate: there is no path from an Authorization header to a TokenClaims that skips the adapter, because that is the property that keeps a decode from becoming a verify.

Implementations

impl TokenClaims

pub fn new() -> Self

Claims with nothing in them, for an adapter to fill in.

pub fn with_subject(self, subject: impl Into<Arc<str>>) -> Self

Sets the subject — who the token is about.

pub fn with_issuer(self, issuer: impl Into<Arc<str>>) -> Self

Sets the issuer that minted the token.

pub fn with_audience(self, audience: ResourceUri) -> Self

Adds an audience entry.

A builder rather than a setter because RFC 7519 §4.1.3 allows aud to be either a single string or an array, and both have to land in the same place.

pub fn with_audience_string(self, audience: impl AsRef<str>) -> Self

Adds an audience entry that arrives as a string.

Skipped rather than fatal when it does not parse. An aud entry that is not an absolute URI cannot equal this server’s resource, so ignoring it and letting the audience check decide is the same answer as refusing — and a server that names one malformed audience alongside a valid one has still issued a usable token, which refusing outright would throw away.

pub const fn with_expiry(self, at: SystemTime) -> Self

Sets when the token stops being valid.

pub const fn with_not_before(self, at: SystemTime) -> Self

Sets when the token starts being valid.

pub fn with_scope(self, scope: impl Into<Arc<str>>) -> Self

Declares a scope the token carries.

pub fn subject(&self) -> Option<&str>

The subject, if the token named one.

pub fn issuer(&self) -> Option<&str>

The issuer, if the token named one.

pub fn audience(&self) -> &[ResourceUri]

Every audience entry, already canonicalised.

pub fn scopes(&self) -> &[Arc<str>]

The scope strings, untranslated.

pub fn is_audience(&self, resource: &ResourceUri) -> bool

Whether the token is bound to resource.

Exact equality against a canonicalised ResourceUri, and equality against any element of aud — which is what RFC 7519 §4.1.3 means by an array audience. “Contains the resource” is the same predicate; what it is not is “contains the resource’s host”, which is the check that would let a sibling server’s token through.

Trait Implementations

impl Clone for TokenClaims

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenClaims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TokenClaims

fn default() -> Self

Returns the “default value” for a type.

impl Eq for TokenClaims

impl PartialEq for TokenClaims

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TokenClaims