Module jwt_ops 

JWT claim extractors used by the audit and authorization paths.

Decodes a bearer token (with or without the Bearer prefix), tolerates both URL-safe and standard Base64 encodings, and returns named claims as String. All failures map to MantaError::JwtMalformed with a structured message; the HTTP layer maps that to a 401.

Security caveat

These helpers do not verify the JWT signature. Claims are extracted on trust. The signature is verified upstream by the backend (CSM / OpenCHAMI) on every call that uses the token, so a forged token with pa_admin in realm_access.roles will still be rejected at the first backend round-trip — but the in-process is_user_admin short-circuit means any code path that returns before the backend call is reached (e.g. a future cached path or a handler that only checks the local roles) would skip every group-access check.

TODO: verify the signature locally against the per-site Keycloak JWKS, cached in ServerState with refresh on kid miss. Tracked as a follow-up because it requires JWKS fetching, key rotation, and a per-site cache. For now treat is_user_admin as advisory: never grant a privilege based on it alone without a follow-up call that hits the backend.

Constants

READ_ONLY_ROLE

Realm role string that puts the server into read-only mode for this caller. A token carrying this role is refused (403 Forbidden) on every mutating endpoint under /api/v1/* by the server’s auth_middleware::read_only_guard.

Statics

PA_ADMIN

Keycloak role name that grants full admin access. Owned here so every workspace crate that decodes JWTs can read it without pulling manta-server as a dependency.

Functions

get_name

Extract the name claim from a JWT token.

get_preferred_username

Extract the preferred_username claim from a JWT token.

get_roles

Extract the realm_access.roles claim from a JWT token.

has_role

Returns true when the token’s realm_access.roles claim contains role. Any JWT-decode failure or missing claim returns false — callers want a yes/no answer, and downstream BearerToken extraction is the auth boundary that surfaces the underlying 401.

is_user_admin

Returns true when the token’s realm_access.roles claim contains the PA_ADMIN role. Errors decoding the JWT are swallowed and treated as “not admin”.