Struct IdentityValidator 

pub struct IdentityValidator { /* private fields */ }

The validator: keyed by kid, audience-bound, and optionally issuer-allowlisted (opt in via IdentityValidator::allow_issuers; with no allowlist configured, any issuer is accepted).

Implementations

impl IdentityValidator

pub fn new(audience: impl Into<String>) -> Self

Create a validator for audience.

pub fn set_human_subject_pattern( &mut self, pattern: &str, ) -> Result<(), IdentityError>

Require every validated token’s sub to match pattern, so each agent identity is attributable to a human principal (for example ^user: or an identity provider’s user-id prefix). Anchor the pattern: it is matched with is_match, anywhere in sub.

pub fn subject_is_human(&self, sub: &str) -> bool

True when sub satisfies the human-principal rule (always true when no pattern is configured).

pub fn add_key( &self, kid: impl Into<String>, key: KeyMaterial, ) -> Result<(), IdentityError>

Register key material under a kid.

Refuse to shadow a JWKS-tracked kid. Without this guard, an ordering hazard silently discarded operator intent: if add_key("X", …) was called for a kid X that a prior add_jwks had installed, the manual entry would overwrite the JWKS one — but jwks_kids still contained X, so the next add_jwks drain would remove X and reinstall the JWKS version, silently discarding the operator’s manual key. add_key is normally a startup call, but nothing in the API constrained late/admin use.

pub fn add_jwks(&self, document: &Value) -> Result<usize, IdentityError>

Add all supported Ed25519 keys from a standard JWKS document. Keys loaded by a previous add_jwks call are retired (replace semantics, so IdP rotation drops superseded JWKS keys); keys registered manually via add_key are left untouched, and a JWKS entry whose kid collides with a manually-registered key is refused so the manual key stays authoritative.

pub fn key_count(&self) -> usize

Number of verification keys currently loaded.

pub fn allow_issuers(&mut self, issuers: Vec<String>)

Restrict accepted issuers.

pub fn set_max_chain_depth(&mut self, depth: usize)

Override the delegation-depth cap (default 4).

pub fn leeway_secs(&self) -> u64

Clock tolerance used when checking token timestamps.

pub fn set_revocation_store(&mut self, store: Arc<dyn RevocationStore>)

Attach a JTI revocation store. When set, the jti of every validated token, and of every token in its delegation chain, is checked against the store; revoked tokens are refused with IdentityError::Revoked.

pub fn revocation_store(&self) -> Option<&Arc<dyn RevocationStore>>

The attached revocation store, so a revocation endpoint writes to the same list this validator reads.

pub fn validate(&self, token: &str) -> Result<ValidatedIdentity, IdentityError>

Validate a token and its full delegation chain.

pub fn validate_for_revocation( &self, token: &str, ) -> Result<ValidatedIdentity, IdentityError>

Authenticate a holder revocation request, including an already-revoked token or a token scheduled within the next maximum token lifetime. Future activation is allowed only for revocation; it never grants access.