Struct JwtClaims 

pub struct JwtClaims {

    pub sub: String,
    pub iat: i64,
    pub exp: i64,
    pub nbf: Option<i64>,
    pub iss: String,
    pub aud: Vec<JwtAudience>,
    pub jti: String,
    pub scope: Vec<Permission>,
    pub username: String,
    pub email: String,
    pub user_type: UserType,
    pub roles: Vec<String>,
    pub attributes: BTreeMap<String, Value>,
    pub client_id: Option<ClientId>,
    pub token_type: TokenType,
    pub auth_time: i64,
    pub session_id: Option<SessionId>,
    pub rate_limit_tier: Option<RateLimitTier>,
    pub plugin_id: Option<String>,
    pub act: Option<ActClaim>,
}

Self-issued JWT claim shape.

Fields are grouped by who consumes them downstream. The platform runs authorization in three layers (see internal/guides/authz.md); each attribute field below is the transport for one of those layers. Do not delete a field without first removing its readers.

Fields

sub: String

iat: i64

exp: i64

nbf: Option<i64>

iss: String

aud: Vec<JwtAudience>

jti: String

scope: Vec<Permission>

PBAC scope: the Permission set this principal is granted. Enforced at every route via with_auth(scope); the first element is the privilege level used by UserType::from_permissions.

username: String

email: String

user_type: UserType

roles: Vec<String>

RBAC attribute: role strings minted from the user row at OAuth issuance. Consumed by authz::resolver::resolve for the core RBAC check against access_control_rules (rule_type = role) and forwarded into every AuthzDecisionHook::evaluate call. The only first-class identity vector core inspects; everything else is extension-defined via attributes.

attributes: BTreeMap<String, Value>

Opaque ABAC attribute bag. The token issuer mints whatever namespaced facts the extension authz hook needs (e.g. "acme.desk": "fixed-income", "boeing.clearance": "ts/sci"). Core never interprets values — keys SHOULD be dotted-namespaced. Forwarded verbatim into AuthzRequest.attributes.

client_id: Option<ClientId>

token_type: TokenType

auth_time: i64

session_id: Option<SessionId>

rate_limit_tier: Option<RateLimitTier>

Rate-limit attribute: minted from UserType::rate_tier so the tier is committed at issuance rather than re-derived per request. Read at the rate-limit middleware via RequestContext::rate_limit_tier().

plugin_id: Option<String>

Hook attribute: the plugin id this token was minted for. Validated by the hook-token validator in systemprompt_security::auth::hook_token — a hook request whose plugin_id claim disagrees with the URL path’s plugin_id is rejected.

act: Option<ActClaim>

Implementations

impl JwtClaims

pub fn has_permission(&self, permission: Permission) -> bool

pub fn permissions(&self) -> &[Permission]

pub fn get_permissions(&self) -> Vec<Permission>

pub fn get_scopes(&self) -> Vec<String>

pub fn is_admin(&self) -> bool

pub fn is_registered_user(&self) -> bool

pub fn is_anonymous(&self) -> bool

pub fn has_audience(&self, aud: &JwtAudience) -> bool

pub fn has_role(&self, role: &str) -> bool

pub fn roles(&self) -> &[String]

Trait Implementations

impl Clone for JwtClaims

fn clone(&self) -> JwtClaims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwtClaims

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for JwtClaims

fn deserialize<__D>( __deserializer: __D, ) -> Result<JwtClaims, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for JwtClaims

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.