Trait TokenSource 

pub trait TokenSource: Send + Sync {
    // Required method
    fn claims(
        &self,
        presented: &str,
    ) -> impl Future<Output = Result<TokenClaims, SourceError>> + Send;
}

Where verified claims come from.

The consumer is authenticate, and the line this port draws is the whole design: an adapter establishes authenticity — the signature checked, or the authorization server asked — and this crate applies authorization: the audience, the expiry, the issuer, the scopes. Neither half can do the other’s job, and in particular a decode is not a verify, which is why TokenClaims has no constructor that takes a raw string.

Object safety

An async fn on a trait is native RPITIT and is not object safe. That is deliberate: the call site takes impl TokenSource, so this monomorphises and pays nothing per call. A deployment that must choose a source at runtime holds an enum over two variants rather than a dyn — which costs less than the per-request boxing that a trait object here would need.

Required Methods

fn claims( &self, presented: &str, ) -> impl Future<Output = Result<TokenClaims, SourceError>> + Send

Establishes what presented says, or refuses it.

presented is the bare token — not an Authorization header. Stripping the scheme is the transport’s job, so that an adapter never has to know which header the credential arrived in.

Dyn Compatibility

This trait is not dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl TokenSource for IntrospectionSource

impl TokenSource for JwtSource