Struct JwtConfig

pub struct JwtConfig {
    pub issuer: String,
    pub audience: String,
    pub algorithms: Vec<Algorithm>,
    pub jwks_uri: Option<String>,
    pub jwks_refresh: Duration,
    pub clock_skew: Duration,
}

Configuration for JwtValidator.

Fields

issuer: String

Expected iss claim.

audience: String

Expected aud claim.

algorithms: Vec<Algorithm>

Whitelist of accepted signing algorithms (RFC 8725 §3.1). Default = [EdDSA] because verify_signature only implements Ed25519 today; RS256/ES256 are reserved for v2.1. Operators who need them today should keep the default and configure their IdP to sign with EdDSA (see with_algorithms_try).

jwks_uri: Option<String>

JWKS URI (optional). If set, keys are fetched from this URL.

jwks_refresh: Duration

JWKS refresh interval. Default = 30 s. Read from the AGENTGUARD_JWKS_REFRESH env var (humantime format).

clock_skew: Duration

Clock skew tolerance for exp/nbf.

Implementations

impl JwtConfig

pub fn new(issuer: impl Into<String>, audience: impl Into<String>) -> Self

pub fn with_algorithms(self, algs: Vec<Algorithm>) -> Result<Self, AuthError>

Replace the accepted-algorithm whitelist. Pass only algorithms that the verifier actually supports today; the set of supported algorithms is exposed via crate::SUPPORTED_ALGORITHMS.

Errors

Returns AuthError::JwtInvalid listing the unsupported entries so misconfiguration is surfaced at construction time, not at the first incoming token.

pub fn with_algorithms_lossy(self, algs: Vec<Algorithm>) -> Self

Lossless infallible variant: only succeeds if every entry is in SUPPORTED_ALGORITHMS, otherwise logs a warning and falls back to the default [EdDSA]. Use this when reading configuration from untrusted sources where panicking on bad input is undesirable (e.g. OIDC discovery).

pub fn with_jwks_uri(self, uri: impl Into<String>) -> Self

pub fn with_jwks_refresh(self, d: Duration) -> Self

pub fn with_jwks_refresh_from_env(self) -> Self

Read the JWKS refresh interval from AGENTGUARD_JWKS_REFRESH (humantime). Falls back to the default when unset or unparseable.

Trait Implementations

impl Clone for JwtConfig

fn clone(&self) -> JwtConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for JwtConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.