Struct ServiceToken 

pub struct ServiceToken { /* private fields */ }

A CipherStash service token returned by an AuthStrategy.

Wraps a bearer credential (SecretToken) together with eagerly decoded JWT claims that are used for service discovery. The JWT is decoded (but not signature-verified) using cts_common::claims::Claims, so only CipherStash-issued service tokens (from CTS or the access-key exchange) will have their claims resolved.

Decoded claims

• subject() — the sub claim (e.g. "CS|auth0|user123").
• workspace_id() — the workspace identifier from the token.
• issuer() — the iss URL, i.e. the CTS host for this workspace.
• zerokms_url() — the ZeroKMS endpoint from the services claim.

For non-JWT tokens (e.g. static test tokens) or JWTs that don’t match the CipherStash claims schema, these methods return Err(AuthError::InvalidToken).

Security

Like SecretToken, this is zeroized on drop and hidden from Debug output.

Implementations

impl ServiceToken

pub fn new(secret: SecretToken) -> Self

Create a ServiceToken from a SecretToken.

If the token string is a valid JWT with iss and services claims, they are decoded eagerly. If decoding fails (not a JWT, missing claims, etc.) the token is still usable as a bearer credential — issuer() and zerokms_url() will simply return an error.

pub fn as_str(&self) -> &str

Expose the inner token string for use as a bearer credential.

pub fn subject(&self) -> Result<&str, AuthError>

Return the sub (subject) claim from the JWT.

In CipherStash tokens the subject encodes the principal identity, e.g. "CS|auth0|user123" for a user or "CS|CSAKkeyId" for an access key.

Errors

Returns AuthError::InvalidToken if the token is not a valid JWT or the claims could not be decoded.

pub fn workspace_id(&self) -> Result<&WorkspaceId, AuthError>

Return the workspace identifier from the JWT claims.

Errors

Returns AuthError::InvalidToken if the token is not a valid JWT or the claims could not be decoded.

pub fn issuer(&self) -> Result<&Url, AuthError>

Return the iss (issuer) URL from the JWT claims.

In CipherStash tokens the issuer is the CTS host URL for the workspace.

Errors

Returns AuthError::InvalidToken if the token is not a valid JWT or the iss claim could not be parsed as a URL.

pub fn services(&self) -> Result<&Services, AuthError>

Return the decoded services map from the JWT claims.

Errors

Returns AuthError::InvalidToken if the token is not a valid JWT or the claims could not be decoded.

pub fn zerokms_url(&self) -> Result<Url, AuthError>

Return the ZeroKMS endpoint URL from the services claim.

CTS-issued JWTs include a services claim containing a map of service type to endpoint URL. This method looks up the zerokms entry.

Errors

Returns AuthError::InvalidToken if the token is not a valid JWT or the services claim does not include a ZeroKMS endpoint.

Trait Implementations

impl Clone for ServiceToken

fn clone(&self) -> ServiceToken

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServiceToken

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for ServiceToken

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl OpaqueDebug for ServiceToken