tower_oauth2_resource_server/
lib.rs

1#![doc = include_str!("../README.md")]
2
3/// [Authorizer](crate::authorizer::token_authorizer::Authorizer) is the struct responsible for
4/// validating requests and performing JWKS rotation against an authorization server.
5///
6/// Not to be used directly.
7/// Only need to be publically exposed for custom implementations of [AuthorizerResolver](crate::auth_resolver::AuthorizerResolver).
8pub mod authorizer;
9
10/// Builder used to construct an [OAuth2ResourceServer](crate::server::OAuth2ResourceServer) instance.
11///
12/// For further information on the different properties,
13/// see [OAuth2ResourceServerBuilder](crate::builder::OAuth2ResourceServerBuilder)
14/// and [TenantConfigurationBuilder](crate::tenant::TenantConfigurationBuilder).
15///
16/// # Example using [DefaultClaims](crate::claims::DefaultClaims)
17///
18/// ```no_run
19/// use tower_oauth2_resource_server::server::OAuth2ResourceServer;
20/// use tower_oauth2_resource_server::tenant::TenantConfiguration;
21///
22/// #[tokio::main]
23/// async fn main() {
24///     let oauth2_resource_server = <OAuth2ResourceServer>::builder()
25///         .add_tenant(TenantConfiguration::builder("https://some-auth-server.com")
26///             .audiences(&["https://some-resource-server.com"])
27///             .build().await.expect("Failed to build tenant configuration"))
28///         .build()
29///         .await;
30/// }
31/// ```
32///
33/// # Example using custom claims implementation
34///
35/// ```no_run
36/// use serde::{Deserialize, Serialize};
37/// use tower_oauth2_resource_server::server::OAuth2ResourceServer;
38/// use tower_oauth2_resource_server::tenant::TenantConfiguration;
39///
40/// #[derive(Clone, Debug, Deserialize, Serialize)]
41/// struct MyClaims {
42///     pub iss: String,
43///     pub scp: Vec<String>
44/// }
45/// #[tokio::main]
46/// async fn main() {
47///     let oauth2_resource_server = OAuth2ResourceServer::<MyClaims>::builder()
48///         .add_tenant(TenantConfiguration::builder("https://some-auth-server.com")
49///             .audiences(&["https://some-resource-server.com"])
50///             .build().await.expect("Failed to build tenant configuration"))
51///         .build()
52///         .await;
53/// }
54/// ```
55pub mod builder;
56
57/// Default claims implementation.
58///
59/// Used by default when constructing a [OAuth2ResourceServer](crate::server::OAuth2ResourceServer).
60///
61/// If you need other claims, an own struct can be provided
62/// to [OAuth2ResourceServer](crate::server::OAuth2ResourceServer) as a
63/// generic parameter.
64pub mod claims;
65
66/// The actual tower middleware
67///
68/// Contains implementations of [Service](https://docs.rs/tower/latest/tower/trait.Service.html)
69/// and [Layer](https://docs.rs/tower/latest/tower/trait.Layer.html)
70/// from the tower library.
71///
72/// You shouldn't need to interact with these implementations, more than
73/// calling [OAuth2ResourceServer::into_layer()](crate::server::OAuth2ResourceServer::into_layer).
74pub mod layer;
75
76/// [OAuth2ResourceServer](crate::server::OAuth2ResourceServer) is
77/// what underpins the tower middleware, and actually performs
78/// JWT validation.
79///
80/// In addition, it queries and maintains a state of public
81/// keys used by the external authorization server.
82///
83/// It's recommended to keep a single instance of this in
84/// an [Arc](https://doc.rust-lang.org/std/sync/struct.Arc.html)
85/// and provide references to it to the different routes
86/// where JWT validation is needed.
87pub mod server;
88
89/// [ClaimsValidationSpec](crate::validation::ClaimsValidationSpec) is used to
90/// optionally customize what claims that are required in incoming JWTs.
91///
92/// Provided when constructing a [OAuth2ResourceServer](crate::server::OAuth2ResourceServer)
93/// via [claims_validation_spec](crate::tenant::TenantConfiguration::claims_validation_spec).
94pub mod validation;
95
96/// [AuthorizerResolver](crate::auth_resolver::AuthorizerResolver) is used to
97/// decide what [Authorizer](crate::authorizer::token_authorizer::Authorizer) that
98/// will validate a request.
99///
100/// By default, either [SingleAuthorizerResolver](crate::auth_resolver::SingleAuthorizerResolver)
101/// or [IssuerAuthorizerResolver](crate::auth_resolver::IssuerAuthorizerResolver) will be used.
102///
103/// You can also provide your own implementation of [AuthorizerResolver](crate::auth_resolver::AuthorizerResolver)
104/// to customize the behavior.
105pub mod auth_resolver;
106
107/// [UnverifiedJwt](crate::jwt_unverified::UnverifiedJwt) is used internally
108/// to represent an unverified JWT.
109///
110/// May be accessed in a custom [AuthorizerResolver](crate::auth_resolver::AuthorizerResolver)
111/// to make decisions based on JWT claims or header.
112pub mod jwt_unverified;
113
114/// [TenantConfiguration](crate::tenant::TenantConfiguration) is used to
115/// configure the interaction with and validation strategy against an authorization server.
116///
117/// Provided when constructing a [OAuth2ResourceServer](crate::server::OAuth2ResourceServer)
118/// via [add_tenant](crate::builder::OAuth2ResourceServerBuilder::add_tenant).
119pub mod tenant;
120
121/// [ErrorHandler](crate::error_handler::ErrorHandler) is used to produce a HTTP response
122/// on authentication error.
123///
124/// A custom implementation may be provided by using [into_layer_with_error_handler](crate::server::OAuth2ResourceServer::into_layer_with_error_handler).
125///
126/// If no implementation is provided, [DefaultErrorHandler](crate::error_handler::DefaultErrorHandler)
127/// will be used.
128pub mod error_handler;
129
130/// Error types
131pub mod error;
132
133mod jwt_extract;
134mod oidc;
tower_oauth2_resource_server/lib.rs

tower_oauth2_resource_server/
lib.rs
