Struct SmooIdentityVerifier 

pub struct SmooIdentityVerifier { /* private fields */ }

Validates a Smoo-issued token — the hosted path (lom.smoo.ai wires Smoo’s identity). Implemented as JWT validation keyed to Smoo’s issuer/audience, reusing JwtVerifier’s internals.

Live introspection (hosted, stubbed)

The fully-hosted variant would call Smoo’s auth server /introspect endpoint (RFC 7662) to validate an opaque token and pull the principal. That requires a network round-trip + a client credential, so it is intentionally not implemented here: SmooIdentityVerifier::introspect documents the contract and returns AuthError::Misconfigured until the introspection client is wired. The JWT form below is the one exercised in tests + the default hosted deployment (Smoo signs a JWT; we verify it locally with Smoo’s public key / shared secret — no per-request network call).

Implementations

impl SmooIdentityVerifier

pub fn hs256(secret: &[u8], issuer: String, audience: Option<String>) -> Self

A Smoo-identity verifier over an HS256 shared secret, keyed to Smoo’s issuer + audience.

pub fn rs256( public_key_pem: &[u8], issuer: String, audience: Option<String>, ) -> Result<Self, AuthError>

A Smoo-identity verifier over an RS256 public key, keyed to Smoo’s issuer + audience.

Errors

Returns AuthError::Misconfigured if the PEM can’t be parsed.

pub fn introspect(&self, _opaque_token: &str) -> Result<Principal, AuthError>

Live token introspection (RFC 7662) against Smoo’s auth server.

Not implemented: this is the opaque-token hosted variant, which needs a network call to {auth_server}/introspect with a client credential and a parse of the introspection response into a Principal. Wiring it is the follow-up; until then this returns AuthError::Misconfigured so a caller can never mistake the stub for a working validator.

Errors

Always returns AuthError::Misconfigured (stub).

Trait Implementations

impl AuthVerifier for SmooIdentityVerifier

fn verify(&self, bearer_token: &str) -> Result<Principal, AuthError>

Validate bearer_token (the raw token, without the Bearer prefix) and return the authenticated Principal.

fn mode(&self) -> &'static str

A short label for logs/metrics (never includes secrets).