Struct JwtConfig 

pub struct JwtConfig { /* private fields */ }

JWT bearer token verification config.

Verify-only: this server validates tokens minted elsewhere; it does not issue them. HS256 (HMAC-SHA256 with a shared secret) is the only supported algorithm in this revision — keeps secret management simple (one env var). RSA/ECDSA can be added later if a deployment needs JWKS-driven key rotation.

Configured from:

• RECURSIVE_HTTP_AUTH_JWT_SECRET — HMAC secret bytes (UTF-8). Empty or unset disables JWT auth.
• RECURSIVE_HTTP_AUTH_JWT_AUDIENCE — optional aud claim that tokens must contain. Unset = audience claim ignored (still valid JWT spec, just less strict).

exp claim is always required (RFC 7519 says optional; we make it mandatory to prevent unbounded-validity tokens).

Implementations

impl JwtConfig

pub fn hs256(secret: &str, audience: Option<String>) -> Option<Self>

Build an HS256 verifier. Returns None if secret is empty (parallels AuthConfig’s “empty = disabled” pattern).

audience is optional: Some("my-app") requires tokens carry "aud": "my-app"; None skips audience checking entirely.

pub fn is_valid(&self, token: &str) -> bool

Verify a token. Returns true iff signature, exp, and (when configured) audience all check out.

Trait Implementations

impl Clone for JwtConfig

fn clone(&self) -> JwtConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.