Struct SignedUrlAuth 

pub struct SignedUrlAuth { /* private fields */ }

Signed URL authenticator using HMAC-SHA256.

This struct provides methods for generating and verifying signed URLs. The signing scheme binds signatures to paths, query params, and expiry times.

Implementations

impl SignedUrlAuth

pub fn new(secret_key: impl AsRef<[u8]>) -> Self

Create a new authenticator with the given secret key.

Arguments

• secret_key - The secret key used for HMAC computation. Should be at least 32 bytes for security.

pub fn sign(&self, path: &str, ttl: Duration) -> (String, u64)

Sign a path with an expiry duration.

Returns the hex-encoded signature and the expiry timestamp (Unix epoch seconds).

Arguments

• path - The URL path to sign (e.g., “/tiles/slides/sample.svs/0/1/2.jpg”)
• ttl - How long the signature should be valid

Returns

A tuple of (signature, expiry_timestamp)

pub fn sign_with_params( &self, path: &str, ttl: Duration, params: &[(&str, &str)], ) -> (String, u64)

Sign a path with extra query parameters.

params should exclude exp and sig; those are added automatically.

pub fn sign_with_expiry(&self, path: &str, expiry: u64) -> String

Sign a path with a specific expiry timestamp.

This is useful when you need to generate signatures for a specific time.

Arguments

• path - The URL path to sign
• expiry - Unix timestamp when the signature expires

Returns

The hex-encoded signature

pub fn sign_with_expiry_and_params( &self, path: &str, expiry: u64, params: &[(&str, &str)], ) -> String

Sign a path with a specific expiry timestamp and extra parameters.

params should exclude exp and sig; those are added automatically.

pub fn verify( &self, path: &str, signature: &str, expiry: u64, params: &[(&str, &str)], ) -> Result<(), AuthError>

Verify a signature for a path and expiry.

Arguments

• path - The URL path that was signed
• signature - The hex-encoded signature to verify
• expiry - The expiry timestamp from the URL

Returns

Ok(()) if the signature is valid and not expired, Err(AuthError) otherwise.

pub fn generate_signed_url( &self, base_url: &str, path: &str, ttl: Duration, extra_params: &[(&str, &str)], ) -> String

Generate a complete signed URL.

Arguments

• base_url - The base URL (e.g., https://example.com)
• path - The path to sign (e.g., “/tiles/slides/sample.svs/0/1/2.jpg”)
• ttl - How long the signature should be valid
• extra_params - Additional query parameters to include

Returns

The complete signed URL

pub fn generate_viewer_token( &self, slide_id: &str, ttl: Duration, ) -> (String, u64)

Generate a viewer token for accessing all tiles of a specific slide.

Viewer tokens are special tokens that authorize access to all tiles for a given slide, rather than signing individual tile paths. This is used by the built-in viewer to access tiles when auth is enabled.

Arguments

• slide_id - The slide identifier
• ttl - How long the token should be valid

Returns

A tuple of (token, expiry_timestamp)

pub fn verify_viewer_token( &self, slide_id: &str, token: &str, expiry: u64, ) -> Result<(), AuthError>

Verify a viewer token for a specific slide.

Arguments

• slide_id - The slide identifier the token should authorize
• token - The hex-encoded viewer token
• expiry - The expiry timestamp

Returns

Ok(()) if the token is valid and not expired, Err(AuthError) otherwise.

Trait Implementations

impl Clone for SignedUrlAuth

fn clone(&self) -> SignedUrlAuth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.