Struct Claims

pub struct Claims {

    pub sub: String,
    pub exp: usize,
    pub iat: Option<usize>,
    pub jti: Option<String>,
    pub email: Option<String>,
    pub phone: Option<String>,
    pub role: Option<String>,
    pub app_metadata: Option<Value>,
    pub user_metadata: Option<Value>,
    pub aud: Option<String>,
    pub iss: Option<String>,
    pub aal: Option<String>,
    pub amr: Option<Vec<Value>>,
    pub session_id: Option<String>,
    pub is_anonymous: Option<bool>,
    pub kid: Option<String>,
}

Represents the claims of a Supabase JWT.

This struct acts as a data carrier for all the claims contained within a JWT, making it easy to access user information and metadata. The validation logic is handled by the JwtParser before the claims are instantiated.

Fields

sub: String

(Subject) The user ID.

exp: usize

(Expiration Time) The timestamp when the token expires.

iat: Option<usize>

(Issued At) The timestamp when the token was issued.

jti: Option<String>

(JWT ID) A unique identifier for the token.

email: Option<String>

The user’s email address.

phone: Option<String>

The user’s phone number.

role: Option<String>

The user’s role.

app_metadata: Option<Value>

Application-specific metadata.

user_metadata: Option<Value>

User-specific metadata.

aud: Option<String>

(Audience) The recipient for which the JWT is intended.

iss: Option<String>

(Issuer) The principal that issued the JWT.

aal: Option<String>

(Authentication Assurance Level) The level of assurance.

amr: Option<Vec<Value>>

(Authentication Methods References) A list of authentication methods.

session_id: Option<String>

The session ID.

is_anonymous: Option<bool>

Indicates if the user is anonymous.

kid: Option<String>

(Key ID) The ID of the key used to sign the token. Not serialized.

Implementations

impl Claims

pub async fn from_token( token: &str, jwks_cache: &JwksCache, ) -> Result<Self, AuthError>

Parses and validates claims from a raw JWT string.

Arguments

• token - The raw JWT string.
• jwks_cache - A reference to the JwksCache for key retrieval.

Returns

A Result containing the validated Claims or an AuthError.

pub async fn from_bearer_token( bearer_token: &str, jwks_cache: &JwksCache, ) -> Result<Self, AuthError>

Parses and validates claims from a “Bearer” token string.

This method expects the token to be prefixed with “Bearer “.

Arguments

• bearer_token - The Bearer token string (e.g., “Bearer eyJ…”).
• jwks_cache - A reference to the JwksCache for key retrieval.

Returns

A Result containing the validated Claims or an AuthError.

pub fn validate_security(&self) -> Result<(), AuthError>

Performs basic security validation on the claims.

This validation is minimal, trusting that Supabase Auth has already performed comprehensive checks. It primarily ensures that the subject (user ID) is not empty.

impl Claims

pub fn user_id(&self) -> &str

Returns the user ID (subject).

pub fn email(&self) -> Option<&str>

Returns the user’s email, if available.

pub fn role(&self) -> &str

Returns the user’s role, defaulting to “authenticated”.

pub fn phone(&self) -> Option<&str>

Returns the user’s phone number, if available.

pub fn is_anonymous(&self) -> bool

Checks if the user is anonymous.

impl Claims

pub fn get_user_metadata<T>(&self, key: &str) -> Option<T>

where T: DeserializeOwned,

Retrieves a specific field from the user metadata.

Arguments

• key - The key of the metadata field to retrieve.

Returns

An Option containing the deserialized value if the key exists.

pub fn get_app_metadata<T>(&self, key: &str) -> Option<T>

where T: DeserializeOwned,

Retrieves a specific field from the application metadata.

Arguments

• key - The key of the metadata field to retrieve.

Returns

An Option containing the deserialized value if the key exists.

Trait Implementations

impl Clone for Claims

fn clone(&self) -> Claims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Claims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Claims

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Claims

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.