Struct TokenClaims 

pub struct TokenClaims { /* private fields */ }

What an adapter established about a presented token, before this crate’s own rules ran.

“Established” means the adapter verified the signature (JWT) or asked the authorization server (introspection). It is deliberately not a type that can be built from a raw string in this crate: there is no path from an Authorization header to a TokenClaims that skips the adapter, because that is the property that keeps a decode from becoming a verify.

Implementations

impl TokenClaims

pub fn new() -> Self

Claims with nothing in them, for an adapter to fill in.

pub fn with_subject(self, subject: impl Into<Arc<str>>) -> Self

Sets the subject — who the token is about.

pub fn with_issuer(self, issuer: impl Into<Arc<str>>) -> Self

Sets the issuer that minted the token.

pub fn with_audience(self, audience: impl Into<Audience>) -> Self

Adds an audience entry.

A builder rather than a setter because RFC 7519 §4.1.3 allows aud to be either a single string or an array, and both have to land in the same place.

pub fn with_audience_string(self, audience: impl AsRef<str>) -> Self

Adds an audience entry that arrives as a string.

Retains every value, including one that is not an absolute URI. That is the change from the behaviour this replaced: an entry that could not parse as a ResourceUri was dropped on the floor, which silently emptied the audience of every token whose aud is a bare identifier. Microsoft Entra v2.0 does exactly that (per Microsoft), so such a token arrived here with nothing to compare against and was refused however the policy was configured — and the refusal named a mismatch rather than a decode that had thrown the answer away.

Nothing is lost by keeping it: the audience check is exact equality against values the deployment named, so an entry nobody configured cannot make a token verify.

pub const fn with_expiry(self, at: SystemTime) -> Self

Sets when the token stops being valid.

pub const fn with_not_before(self, at: SystemTime) -> Self

Sets when the token starts being valid.

pub fn with_scope(self, scope: impl Into<Arc<str>>) -> Self

Declares a scope the token carries.

pub fn subject(&self) -> Option<&str>

The subject, if the token named one.

pub fn issuer(&self) -> Option<&str>

The issuer, if the token named one.

pub fn audience(&self) -> &[Audience]

Every audience entry, as the authorization server wrote it.

pub fn scopes(&self) -> &[Arc<str>]

The scope strings, untranslated.

pub fn is_audience(&self, audience: &ResourceUri) -> bool

Whether the token is bound to audience.

Exact, case-sensitive equality against a canonicalised ResourceUri, and equality against any element of aud — which is what RFC 7519 §4.1.3 means by an array audience. “Contains the audience” is the same predicate; what it is not is “contains the audience’s host”, which is the check that would let a sibling server’s token through.

pub fn is_audience_str(&self, audience: &str) -> bool

Whether the token is bound to the audience audience names.

The string form, for an aud that is not an absolute URI — a bare GUID, which is what a Microsoft Entra v2.0 token carries. Same exact equality as Self::is_audience; there is deliberately no prefix or host matching anywhere in this check.

Trait Implementations

impl Clone for TokenClaims

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenClaims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TokenClaims

fn default() -> Self

Returns the “default value” for a type.

impl Eq for TokenClaims

impl PartialEq for TokenClaims

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TokenClaims