iet-auth-session-jwt

Issues stateless JWT credentials with optional authoritative revocation.

How to use it

iet-auth-session-jwt issues and validates stateless HS256 JWT credentials through TokenIssuer and Authenticate. Plain JwtSessions cannot be revoked; calling with_revocations returns a RevocableJwt that checks an authoritative denylist on every request and adds Invalidate. Storage for that denylist is a separate adapter.

// crates/features/iet-auth-session-jwt/src/lib.rs
use iet_auth::{Authenticate, Invalidate, Secret, TokenIssuer};
use iet_auth_session_jwt::{JwtSessions, config::JwtConfig};
use iet_core::Principal;

let jwt = JwtSessions::new(JwtConfig {
    secret: Secret::new("a".repeat(64)),   // >= 32 bytes, cryptographically random
    issuer: "test".into(),
    audience: "api".into(),
    ttl_seconds: 60,
})?
// Select authoritative revocation; required before calling `invalidate`.
.with_revocations(store);

let identity = Principal { subject: "user".into(), profile: Some("buyer".into()) };
let token = jwt.issue(&identity).await?;            // independent per issue call
assert_eq!(jwt.authenticate(&token).await?, identity);
jwt.invalidate(&token).await?;                     // rejected on next authenticate
assert!(jwt.authenticate(&token).await.is_err());

• Claims require sub, iss, aud, iat, nbf, exp, and a UUIDv7 jti; TTL is capped at 86400 seconds.
• JwtConfig.secret must be at least 32 bytes; only length is checked, so supply real randomness.
• Without with_revocations a token cannot be invalidated: JwtSessions has no Invalidate impl.

How it works

issue encodes HS256 claims with a UUIDv7 jti; authenticate decodes and validates them and, on RevocableJwt, also checks the SHA-256 digest against the denylist; invalidate records that digest until the token's expiry.

sequenceDiagram
  participant C as "Caller"
  participant J as "RevocableJwt"
  participant V as "TokenRevocations"
  C->>J: "issue identity"
  J-->>C: "Secret JWT"
  C->>J: "authenticate token"
  J->>J: "decode validate claims"
  J->>V: "revoked digest"
  V-->>J: "bool"
  J-->>C: "Principal or jwt.invalid"
  C->>J: "invalidate token"
  J->>V: "revoke digest expiry"

What it implements

• Implements iet_auth::TokenIssuer from iet-auth.
• Implements iet_auth::Authenticate<Secret<String>> from iet-auth.
• Implements iet_auth::Invalidate<Secret<String>> (revocable form) from iet-auth.

What's inside

Modules

• src/config.rs
• src/lib.rs

Public API

(root)

• struct JwtSessions
• pub fn new(config: config::JwtConfig) -> AppResult<Self> — Key length is checked, not entropy. Supply a cryptographically random secret.
• pub fn with_revocations<R: TokenRevocations>(self, store: R) -> RevocableJwt<R>
• struct RevocableJwt — No Invalidate implementation exists for stateless JwtSessions: it cannot revoke. This wrapper explicitly selects authoritative revocation lookups on every request.

config

• struct JwtConfig

Impl map

• TokenIssuer for JwtSessions
• Authenticate<Secret<String>> for JwtSessions
• TokenIssuer for RevocableJwt<R>
• Authenticate<Secret<String>> for RevocableJwt<R>
• Invalidate<Secret<String>> for RevocableJwt<R>

Depends on

• iet-telemetry
• iet-auth
• iet-core
• iet-config
• iet-config-macros

External crates: jsonwebtoken, serde, sha2, uuid

Used by

• No other framework crate depends on it directly.

In this repository

• Not used by a checked-in example yet.

Source: crates/features/iet-auth-session-jwt