Struct AuthContext 

pub struct AuthContext {

    pub sub: String,
    pub iss: Option<String>,
    pub aud: Option<String>,
    pub exp: Option<u64>,
    pub iat: Option<u64>,
    pub nbf: Option<u64>,
    pub jti: Option<String>,
    pub user: UserInfo,
    pub roles: Vec<String>,
    pub permissions: Vec<String>,
    pub scopes: Vec<String>,
    pub request_id: Option<String>,
    pub authenticated_at: SystemTime,
    pub expires_at: Option<SystemTime>,
    pub token: Option<TokenInfo>,
    pub provider: String,
    pub dpop_jkt: Option<String>,
    pub metadata: HashMap<String, Value>,
}

Unified authentication context containing user identity, claims, and session metadata.

This type serves as both:

• The internal authentication representation
• The JWT claims structure (via to_jwt_claims / from_jwt_claims)

Standard JWT Claims (RFC 7519)

• sub: Subject (user ID)
• iss: Issuer (who issued the token)
• aud: Audience (who the token is for)
• exp: Expiration time (Unix timestamp)
• iat: Issued at (Unix timestamp)
• nbf: Not before (Unix timestamp)
• jti: JWT ID (unique identifier)

Extended Claims

• user: Full user information
• roles: RBAC roles
• permissions: Fine-grained permissions
• scopes: OAuth scopes
• request_id: Request identifier for replay protection (NOT session-based)
• provider: Auth provider identifier
• metadata: Custom claims

Example

use turbomcp_auth::context::{AuthContext, AuthContextBuilder};

let ctx = AuthContext::builder()
    .subject("user123")
    .user(user_info)
    .roles(vec!["admin".into(), "user".into()])
    .permissions(vec!["read:posts".into(), "write:posts".into()])
    .build();

// Check authorization
if ctx.has_role("admin") && ctx.has_permission("write:posts") {
    // Allow action
}

Fields

sub: String

Subject (typically user ID)

iss: Option<String>

Issuer (who issued this token)

aud: Option<String>

Audience (who this token is for)

exp: Option<u64>

Expiration time (Unix timestamp)

iat: Option<u64>

Issued at (Unix timestamp)

nbf: Option<u64>

Not before (Unix timestamp)

jti: Option<String>

JWT ID (unique identifier)

user: UserInfo

Full user information

roles: Vec<String>

RBAC roles (e.g., [“admin”, “user”])

permissions: Vec<String>

Fine-grained permissions (e.g., [“read:posts”, “write:posts”])

scopes: Vec<String>

OAuth scopes (e.g., [“openid”, “email”, “profile”])

request_id: Option<String>

Request ID for nonce/replay protection (MCP compliant - NOT session-based)

Per MCP security requirements, servers MUST NOT use sessions for authentication. This field is for request-level binding (DPoP nonces, one-time tokens, etc.), not session management. Each request must include valid credentials.

authenticated_at: SystemTime

When authentication occurred

expires_at: Option<SystemTime>

When this context expires (may differ from JWT exp)

token: Option<TokenInfo>

Token information (access + refresh tokens)

provider: String

Auth provider (e.g., “oauth2:google”, “api_key”, “jwt:internal”)

dpop_jkt: Option<String>

DPoP JWK thumbprint for token binding

metadata: HashMap<String, Value>

Custom metadata (tenant_id, org_id, etc.)

Implementations

impl AuthContext

pub fn builder() -> AuthContextBuilder

Create builder for constructing auth context

pub fn to_jwt_claims(&self) -> Value

Convert to JWT claims (for signing)

Serializes the entire AuthContext into a JSON value suitable for JWT encoding. Standard JWT claims (sub, iss, aud, exp, iat, nbf, jti) are included at the top level.

Example

let claims = auth_ctx.to_jwt_claims();
let token = jwt_encoder.encode(&claims)?;

pub fn from_jwt_claims(claims: Value) -> Result<Self, AuthError>

Create from JWT claims (after validation)

Deserializes a validated JWT claims object into an AuthContext.

Errors

Returns error if:

• Required fields are missing (sub, user, provider)
• Field types don’t match expected types
• Invalid timestamps

pub fn is_expired(&self) -> bool

Check if token is expired

Uses expires_at field if present, otherwise falls back to exp claim.

pub fn validate(&self, config: &ValidationConfig) -> Result<(), AuthError>

Validate all fields (exp, nbf, aud, iss)

Performs comprehensive validation according to RFC 7519.

Errors

Returns error if:

• Token is expired (with leeway)
• Token not yet valid (nbf with leeway)
• Audience mismatch
• Issuer mismatch

pub fn has_role(&self, role: &str) -> bool

Check if user has specific role

pub fn has_any_role(&self, roles: &[&str]) -> bool

Check if user has any of the roles

pub fn has_all_roles(&self, roles: &[&str]) -> bool

Check if user has all of the roles

pub fn has_permission(&self, perm: &str) -> bool

Check if user has specific permission

pub fn has_any_permission(&self, perms: &[&str]) -> bool

Check if user has any of the permissions

pub fn has_all_permissions(&self, perms: &[&str]) -> bool

Check if user has all of the permissions

pub fn has_scope(&self, scope: &str) -> bool

Check if token has specific scope

pub fn has_any_scope(&self, scopes: &[&str]) -> bool

Check if token has any of the scopes

pub fn has_all_scopes(&self, scopes: &[&str]) -> bool

Check if token has all of the scopes

pub fn get_metadata<T: DeserializeOwned>(&self, key: &str) -> Option<T>

Get custom metadata value

Deserializes a custom metadata field into the specified type.

Example

if let Some(tenant_id) = auth_ctx.get_metadata::<String>("tenant_id") {
    println!("Tenant: {}", tenant_id);
}

pub fn validate_dpop_proof(&self, proof: &DpopProof) -> Result<(), AuthError>

Validate DPoP proof (RFC 9449)

Verifies that the DPoP proof matches the bound JWK thumbprint.

Trait Implementations

impl Clone for AuthContext

fn clone(&self) -> AuthContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuthContext

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuthContext

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.