Struct IdentityValidator 

pub struct IdentityValidator { /* private fields */ }

The validator: keyed by kid, audience-bound, and optionally issuer-allowlisted (opt in via IdentityValidator::allow_issuers; with no allowlist configured, any issuer is accepted).

Implementations

impl IdentityValidator

pub fn new(audience: impl Into<String>) -> Self

Create a validator for audience.

pub fn add_key( &self, kid: impl Into<String>, key: KeyMaterial, ) -> Result<(), IdentityError>

Register key material under a kid.

Round-25 F2: refuse to shadow a JWKS-tracked kid. Without this guard, an ordering hazard silently discarded operator intent: if add_key("X", …) was called for a kid X that a prior add_jwks had installed, the manual entry would overwrite the JWKS one — but jwks_kids still contained X, so the next add_jwks drain would remove X and reinstall the JWKS version, silently discarding the operator’s manual key. add_key is normally a startup call, but nothing in the API constrained late/admin use.

pub fn add_jwks(&self, document: &Value) -> Result<usize, IdentityError>

Add all supported Ed25519 keys from a standard JWKS document. Keys loaded by a previous add_jwks call are retired (replace semantics, so IdP rotation drops superseded JWKS keys); keys registered manually via add_key are left untouched, and a JWKS entry whose kid collides with a manually-registered key is refused so the manual key stays authoritative.

pub fn key_count(&self) -> usize

Number of verification keys currently loaded.

pub fn allow_issuers(&mut self, issuers: Vec<String>)

Restrict accepted issuers.

pub fn set_max_chain_depth(&mut self, depth: usize)

Override the delegation-depth cap (default 4).

pub fn validate(&self, token: &str) -> Result<ValidatedIdentity, IdentityError>

Validate a token and its full delegation chain.