Struct AuthClaims 

pub struct AuthClaims {
    pub did: String,
    pub role: Role,
    pub allowed_contexts: Vec<String>,
    pub session_id: String,
    pub access_expires_at: u64,
    pub amr: Vec<String>,
    pub acr: String,
}

Extracted from a valid JWT Bearer token on protected routes.

Add this as a handler parameter to require authentication:

async fn handler(_auth: AuthClaims, ...) { }

Fields

did: String

role: Role

allowed_contexts: Vec<String>

session_id: String

JWT session_id claim. Carried through so handlers can do session-targeted operations (sign-out, refresh-token rotation) without re-decoding the JWT.

access_expires_at: u64

JWT exp claim — Unix-second expiry. Surfaced so whoami-style endpoints can return the access-token lifetime without re-decoding.

amr: Vec<String>

Authentication Methods References per [RFC 8176]. Mirrors Claims.amr from the bearer JWT. Handlers gating sensitive operations check this to decide whether a step-up is needed.

acr: String

Authentication Context Class Reference per OIDC Core §2. Typical values: "aal1" / "aal2" / "aal3". Handlers gating step-up read this directly.

Implementations

impl AuthClaims

pub fn act_scope(&self) -> ActScope

This caller’s authority to act, decoded from (role, allowed_contexts).

Use this — or has_context_access, which is built on it — rather than inspecting allowed_contexts directly. An empty list means unrestricted for Role::Admin and nothing at all for every other role; a call site that tests is_empty() without the role gets one of those two cases backwards. See ActScope.

pub fn is_super_admin(&self) -> bool

Returns true if the caller is an admin whose ActScope is unrestricted.

pub fn has_context_access(&self, context_id: &str) -> bool

Returns true if the caller may act in the given context — because their ActScope is unrestricted, or because it names context_id itself or an ancestor of it (folder-level authority: admin of a parent context covers the whole subtree).

Ancestry is the segment-aware is_ancestor_or_self — a pure, store-free check over the verified JWT’s contexts. For today’s flat (single-segment, childless) contexts this is identical to the previous exact match.

pub fn with_delegated_contexts(&self, extra: &[String]) -> Self

Clone these claims with extra contexts merged into allowed_contexts.

This is how a consented per-task delegation is realized: an approver who holds admin in a context authorizes one specific task, and the executor runs that one dispatch under the requester’s identity widened to include the delegated context. The widening lives only for the single consented, payload-bound, single-use execution — it is never persisted onto the session or the JWT, so the agent accrues no standing authority.

Never widens a super-admin (empty allowed_contexts already means “all contexts”, so there is nothing to add and replacing the empty list would wrongly narrow it) and is a no-op when extra is empty. Duplicates are dropped so repeated delegation can’t bloat the list.

pub fn with_delegated_authority(&self, extra: &[String]) -> Self

Realize a consented grant for a single dispatch: the approval conferred full authority over extra, so the requester need hold no standing admin at all.

Unlike [with_delegated_contexts] — which widens context but keeps the requester’s role — this also lifts the role to Role::Admin, because the grant authorizes the exact bound task in full. That is what lets a purely unprivileged agent (a Reader that can act nowhere) execute a task an approver blessed: the approval is the authority. Ephemeral in exactly the same way as the context widening — built for one dispatch, never persisted to the session, JWT, or ACL — so the agent accrues no standing power.

A no-op when extra is empty (nothing was delegated — an ordinary same-context, already-authorized execution) and for a super-admin (already unrestricted; adding to the empty list would wrongly narrow it).

pub fn require_context(&self, context_id: &str) -> Result<(), AppError>

Check that the caller has access to the given context.

Admins with an empty allowed_contexts list have unrestricted access.

pub fn default_context(&self) -> Option<&str>

If the caller has exactly one allowed context, return it.

pub fn require_read(&self) -> Result<(), AppError>

Require at least Reader role (all roles except Monitor).

Use for read-only endpoints that access business data (keys, contexts, DIDs). Monitor can only see metrics and health.

pub fn require_write(&self) -> Result<(), AppError>

Require at least Application role (Admin, Initiator, or Application).

Use for write operations: signing, cache writes, and other actions that produce artifacts or modify state.

pub fn require_admin(&self) -> Result<(), AppError>

Require the caller to have Admin role.

pub fn require_manage(&self) -> Result<(), AppError>

Require the caller to have Admin or Initiator role.

pub fn require_super_admin(&self) -> Result<(), AppError>

Require the caller to be a super admin (Admin + unrestricted).

Trait Implementations

impl Clone for AuthClaims

fn clone(&self) -> AuthClaims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthClaims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthClaims

fn default() -> AuthClaims

Returns the “default value” for a type.

impl<S: AuthState> FromRequestParts<S> for AuthClaims

type Rejection = AppError

If the extractor fails it’ll use this “rejection” type. A rejection is a kind of error that can be converted into a response.

async fn from_request_parts( parts: &mut Parts, state: &S, ) -> Result<Self, Self::Rejection>

Perform the extraction.