Struct JwtVerifier 

pub struct JwtVerifier { /* private fields */ }

Validates a JWT and extracts a Principal. The BYO path: SST OpenAuth (or any OIDC IdP) issues the token; this verifies signature + standard claims and maps sub→user_id, org/org_id→org_id, role→Role, name→display_name.

Implementations

impl JwtVerifier

pub fn hs256( secret: &[u8], issuer: Option<String>, audience: Option<String>, ) -> Self

An HS256 verifier over a shared secret. Optionally constrains iss/aud.

pub fn rs256( public_key_pem: &[u8], issuer: Option<String>, audience: Option<String>, ) -> Result<Self, AuthError>

An RS256 verifier over a PEM-encoded public key. Optionally constrains iss/aud. (Structural RS256 support — a JWKS-url variant would fetch + cache keys; see AuthConfig.)

Errors

Returns AuthError::Misconfigured if the PEM can’t be parsed.

Trait Implementations

impl AuthVerifier for JwtVerifier

fn verify(&self, bearer_token: &str) -> Result<Principal, AuthError>

Validate bearer_token (the raw token, without the Bearer prefix) and return the authenticated Principal.

fn mode(&self) -> &'static str

A short label for logs/metrics (never includes secrets).