Struct Claims 

pub struct Claims {
    pub aud: String,
    pub sub: String,
    pub session_id: String,
    pub role: String,
    pub contexts: Vec<String>,
    pub exp: u64,
    pub iat: u64,
    pub tee_attested: bool,
    pub amr: Vec<String>,
    pub acr: String,
    pub jti: String,
}

JWT claims for VTA/VTC access tokens.

Aligns with the OIDC Core §2 / RFC 8176 vocabulary so the same claim names other identity stacks emit work here unchanged:

• amr — Authentication Methods References. Per [RFC 8176] the canonical short strings are pwd, hwk, swk, iris, face, sms, etc.; the VTI vocabulary in current use is "did" (challenge-response), "passkey" (WebAuthn), "vta" (verifiable-trust-agent attestation). Multi-factor sessions list every method that contributed.
• acr — Authentication Context Class Reference. The recommended set is "aal1" (single-factor DID), "aal2" (a second possession-or-biometric factor confirmed), "aal3" (hardware-bound second factor).

Default derives so test fixtures and follow-up constructions can use Claims { aud: ..., ..Default::default() } without listing every field — production minters still set the values that matter, but the boilerplate at non-load-bearing call sites (default-empty in tests, mocks, examples) stays out of the way.

Fields

aud: String

sub: String

session_id: String

role: String

contexts: Vec<String>

exp: u64

iat: u64

Issued-at, Unix seconds. Mirrors OIDC Core §2 / RFC 7519 §4.1.6. The extractor doesn’t gate on it directly — exp is the only mandatory freshness check — but iat lets audit logs and downstream consumers distinguish a re-issued token from the original mint, and lets clock-skew analysis detect a stuck issuer.

#[serde(default)] so tokens minted before iat landed deserialise as iat=0 — never confused with a fresh mint because iat==0 is older than any real session.

tee_attested: bool

Indicates the service is running inside a Trusted Execution Environment. Only present (and true) when TEE is active; omitted when false to reduce token size.

amr: Vec<String>

Authentication Methods References per [RFC 8176]. Empty when the consumer’s authentication path did not categorise the factor (e.g. legacy tokens minted before AAL plumbing landed).

acr: String

Authentication Context Class Reference per OIDC Core §2. Empty when not categorised.

jti: String

JWT ID (RFC 7519 §4.1.7) — a per-issue nonce that pins this access token to the session’s current token_id. The extractor rejects a token whose jti does not match Session.token_id (when that field is set), so minting a fresh token immediately supersedes the prior one for the same session. Load-bearing once a session_id stops rotating on refresh; harmless before then (each session already has exactly one live token). #[serde(default)] so pre-jti tokens deserialise with an empty string and are treated as “no pin” by sessions that predate the field.

Implementations

impl Claims

pub fn with_jti(self, jti: impl Into<String>) -> Self

Builder-style setter for the amr + acr claims. Production minters that know how the session was authenticated call this after JwtKeys::new_claims to attach the AAL signal:

let claims = jwt_keys.new_claims(/* ... */)
    .with_aal(vec!["did".into()], "aal1");

Step-up flows append a factor and raise the acr:

claims = claims.with_aal(vec!["did".into(), "passkey".into()], "aal2");

Builder-style setter for the jti pin. Minters call this after JwtKeys::new_claims with the same value they persist as the session’s token_id, so the extractor’s pin check matches. Defaults to empty (no pin) when not called.

pub fn with_aal(self, amr: Vec<String>, acr: impl Into<String>) -> Self

Trait Implementations

impl Debug for Claims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Claims

fn default() -> Claims

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Claims

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Claims

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.