Validate a JWT token during WebSocket upgrade. Called before the sync session is created. If this returns `Rejected`, the WebSocket connection is closed immediately with a 4001 close code.
(token: &str, config: &JwtConfig)
| 58 | /// Called before the sync session is created. If this returns `Rejected`, |
| 59 | /// the WebSocket connection is closed immediately with a 4001 close code. |
| 60 | pub fn validate_upgrade_token(token: &str, config: &JwtConfig) -> UpgradeAuthResult { |
| 61 | let validator = JwtValidator::new(config.clone()); |
| 62 | match validator.validate(token) { |
| 63 | Ok(identity) => { |
| 64 | // Decode claims again to get raw `exp` for refresh scheduling. |
| 65 | let expires_in = extract_exp_from_token(token).unwrap_or(0); |
| 66 | let now = now_epoch_secs(); |
| 67 | let remaining = expires_in.saturating_sub(now); |
| 68 | |
| 69 | UpgradeAuthResult::Authenticated { |
| 70 | identity, |
| 71 | expires_in_secs: remaining, |
| 72 | } |
| 73 | } |
| 74 | Err(e) => UpgradeAuthResult::Rejected { |
| 75 | reason: e.to_string(), |
| 76 | }, |
| 77 | } |
| 78 | } |
| 79 | |
| 80 | /// Check if a token needs refresh (within refresh window of expiry). |
| 81 | /// |