Struct ApiKeyEntry 

#[non_exhaustive]
pub struct ApiKeyEntry {
    pub name: String,
    pub hash: String,
    pub role: String,
    pub expires_at: Option<RfcTimestamp>,
}

A single API key entry (stored as Argon2id hash in config).

The Debug impl is manually written to redact the Argon2id hash. Although the hash is not directly reversible, treating it as a secret prevents offline brute-force attempts from leaked logs and matches the defense-in-depth posture used for AuthIdentity.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

name: String

Human-readable key label (used in logs and audit records).

hash: String

Argon2id hash of the token (PHC string format).

role: String

RBAC role granted when this key authenticates successfully.

expires_at: Option<RfcTimestamp>

Optional expiry, parsed from an RFC 3339 string at deserialization time. Construction from a raw string is fallible (see RfcTimestamp::parse and ApiKeyEntry::try_with_expiry), which guarantees verify_bearer_token never sees a malformed value.

Implementations

impl ApiKeyEntry

pub fn new( name: impl Into<String>, hash: impl Into<String>, role: impl Into<String>, ) -> Self

Create a new API key entry (no expiry).

pub fn with_expiry(self, expires_at: RfcTimestamp) -> Self

Set an RFC 3339 expiry on this key.

Takes an already-parsed RfcTimestamp; for ergonomic construction from a raw string see Self::try_with_expiry.

pub fn try_with_expiry( self, expires_at: impl AsRef<str>, ) -> Result<Self, ParseError>

Set an RFC 3339 expiry on this key from a raw string.

Errors

Returns the underlying chrono::ParseError when expires_at is not a valid RFC 3339 timestamp. This is the fallible counterpart to Self::with_expiry.

Trait Implementations

impl Clone for ApiKeyEntry

fn clone(&self) -> ApiKeyEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ApiKeyEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Redacts the Argon2id hash to keep it out of logs, panic backtraces, and admin-endpoint responses that might format!("{:?}", …) an entry.

impl<'de> Deserialize<'de> for ApiKeyEntry

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.