Struct ServiceToken 

pub struct ServiceToken { /* private fields */ }

A CipherStash service token returned by an AuthStrategy.

Wraps a bearer credential (SecretToken) together with eagerly decoded JWT claims that are used for service discovery. The JWT is decoded (but not signature-verified) using cts_common::claims::Claims, so only CipherStash-issued service tokens (from CTS or the access-key exchange) will have their claims resolved.

Decoded claims

• issuer() — the iss URL, i.e. the CTS host for this workspace.
• audience() — the aud claim, typically the ZeroKMS endpoint.

For non-JWT tokens (e.g. static test tokens) or JWTs that don’t match the CipherStash claims schema, both methods return Err(AuthError::InvalidToken).

Security

Like SecretToken, this is zeroized on drop and hidden from Debug output.

Implementations

impl ServiceToken

pub fn new(secret: SecretToken) -> Self

Create a ServiceToken from a SecretToken.

If the token string is a valid JWT with iss and aud claims, they are decoded eagerly. If decoding fails (not a JWT, missing claims, etc.) the token is still usable as a bearer credential — issuer() and audience() will simply return an error.

pub fn as_str(&self) -> &str

Expose the inner token string for use as a bearer credential.

pub fn issuer(&self) -> Result<&Url, AuthError>

Return the iss (issuer) URL from the JWT claims.

In CipherStash tokens the issuer is the CTS host URL for the workspace.

Errors

Returns AuthError::InvalidToken if the token is not a valid JWT or the iss claim could not be parsed as a URL.

pub fn audience(&self) -> Result<&Audience, AuthError>

Return the aud (audience) from the JWT claims.

Errors

Returns AuthError::InvalidToken if the token is not a valid JWT.

Trait Implementations

impl Clone for ServiceToken

fn clone(&self) -> ServiceToken

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServiceToken

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for ServiceToken

fn drop(&mut self)

Executes the destructor for this type.

impl OpaqueDebug for ServiceToken