Struct JwtSource 

pub struct JwtSource { /* private fields */ }

Verifies JWT access tokens against a published key set.

Implementations

impl JwtSource

pub fn new(jwks_uri: impl Into<Arc<str>>, accepted: Vec<Algorithm>) -> Self

A source reading keys from jwks_uri.

Opens no socket and reads no clock, so a source can be built at startup and the first fetch happens on the first request that needs it. A deployment that would rather pay that at startup has warm.

accepted is the algorithms this deployment will verify. It is a parameter rather than a default because the safe default is not obvious: a list that is too long accepts a downgrade, and a list that is too short refuses a signer that is working. RS256 alone is the common answer, and it is what default_algorithms returns.

pub fn with_http_client(self, http: Client) -> Self

Replaces the HTTP client, for a caller that needs a timeout or a proxy.

There is no with_timeout shortcut: reqwest’s builder returns a Result, and a shortcut would either swallow that error or force every caller through a Result for a knob they can already reach.

pub fn invalidate(&self)

Forgets the cached keys so the next request fetches again.

For a deployment told out of band that the authorization server rotated its keys, rather than waiting out the refresh floor.

pub async fn warm(&self) -> Result<(), SourceError>

Fetches the key set now, so a missing authorization server is a startup failure rather than a 401 under the first real request.

Errors

A transport or parse failure. The reason is carried; nothing borrowed from a token is, because no token has been involved yet.

pub fn accepted_algorithms(&self) -> &[Algorithm]

The algorithms this source will verify.

Trait Implementations

impl Clone for JwtSource

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwtSource

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl TokenSource for JwtSource

async fn claims(&self, presented: &str) -> Result<TokenClaims, SourceError>

Establishes what presented says, or refuses it.