Struct Claims 

pub struct Claims {
    pub sub: String,
    pub exp: u64,
    pub iat: u64,
    pub iss: String,
    pub roles: Vec<String>,
    pub email: Option<String>,
    pub node_id: Option<String>,
}

JWT claims used by every protected endpoint.

node_id is Some only on node JWTs — tokens issued by the leader during cluster join with roles: ["node"] so a node can authenticate to its peers’ internal endpoints distinct from any user identity. All other JWT issuers leave it None.

Fields

sub: String

Subject — user id, api-key id, or "node:{node_id}" for node JWTs.

exp: u64

Expiration time (Unix seconds).

iat: u64

Issued at (Unix seconds).

iss: String

Issuer (canonically "zlayer"; federation will use a cluster-id form).

roles: Vec<String>

Role claims, e.g. ["admin"], ["operator"], ["node"].

#[serde(default)] preserves back-compat with tokens minted before the field existed.

email: Option<String>

Email — embedded for session JWTs so the manager UI doesn’t have to round-trip to the user store on every request.

node_id: Option<String>

Cluster-wide node UUID. Some only for JWTs minted by the leader at cluster-join time (where roles contains "node"). All other token kinds leave this None.

Implementations

impl Claims

pub fn new( subject: impl Into<String>, expiry: Duration, roles: Vec<String>, email: Option<String>, ) -> Self

Create new claims.

node_id is left None; node JWTs are constructed via struct literal at the cluster-join site.

Panics

Panics if the system clock is before the Unix epoch.

pub fn is_expired(&self) -> bool

Check if token is expired.

Panics

Panics if the system clock is before the Unix epoch.

pub fn has_role(&self, role: &str) -> bool

Check if the user has a specific role

Trait Implementations

impl Clone for Claims

fn clone(&self) -> Claims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Claims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Claims

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Claims

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.