Module jwt_ops 

JWT decode helpers (relocated to manta_shared::common::jwt_ops).

This module is a thin re-export so server-side call sites that reach crate::server::common::jwt_ops::* continue to resolve without churn. New code should prefer the canonical path manta_shared::common::jwt_ops.

Constants

READ_ONLY_ROLE

Realm role string that puts the server into read-only mode for this caller. A token carrying this role is refused (403 Forbidden) on every mutating endpoint under /api/v1/* by the server’s auth_middleware::read_only_guard.

Statics

PA_ADMIN

Keycloak role name that grants full admin access. Owned here so every workspace crate that decodes JWTs can read it without pulling manta-server as a dependency.

Functions

get_name

Extract the name claim from a JWT token.

get_preferred_username

Extract the preferred_username claim from a JWT token.

get_roles

Extract the realm_access.roles claim from a JWT token.

has_role

Returns true when the token’s realm_access.roles claim contains role. Any JWT-decode failure or missing claim returns false — callers want a yes/no answer, and downstream BearerToken extraction is the auth boundary that surfaces the underlying 401.

is_user_admin

Returns true when the token’s realm_access.roles claim contains the PA_ADMIN role. Errors decoding the JWT are swallowed and treated as “not admin”.