max / makenotwork

server: document synckit_auth token-claim and extractor fields Fill the per-field doc gaps in OAuthAccessClaims (its sibling SyncClaims already documents every field) and in the SyncUser / OAuthUser request extractors. Doc comments only, no code change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-25 00:42 UTC

Commit: 42d668a89f0e4f660aeb49f6e27c01d7126df888

Parent: 0b594dc

1 file changed, +12 insertions, -0 deletions

M server/src/synckit_auth.rs +12

			@@ -171,7 +171,9 @@ pub async fn assert_token_live(
171	171
172	172		/// Authenticated sync user extracted from JWT Bearer token.
173	173		pub struct SyncUser {
	174	+	/// The authenticated user.
174	175		pub user_id: UserId,
	176	+	/// The SyncKit app the token was minted for.
175	177		pub app_id: SyncAppId,
176	178		/// SDK key this session was minted under. All writes attributed here.
177	179		pub key: String,
			@@ -224,13 +226,21 @@ impl FromRequestParts<AppState> for SyncUser {
224	226		/// each other's tokens. `scope` is the space-delimited granted scope.
225	227		#[derive(Debug, Serialize, Deserialize)]
226	228		pub struct OAuthAccessClaims {
	229	+	/// User ID
227	230		pub sub: UserId,
	231	+	/// App ID
228	232		pub app: SyncAppId,
	233	+	/// SDK key this session belongs to (per-key storage attribution).
229	234		pub key: String,
	235	+	/// Space-delimited granted scope string.
230	236		pub scope: String,
	237	+	/// Issuer
231	238		pub iss: String,
	239	+	/// Audience
232	240		pub aud: String,
	241	+	/// Expiration (Unix timestamp)
233	242		pub exp: i64,
	243	+	/// Issued at (Unix timestamp)
234	244		pub iat: i64,
235	245		}
236	246
			@@ -294,7 +304,9 @@ pub fn decode_oauth_access_token(secret: &str, token: &str) -> Result<OAuthAcces
294	304		/// shared [`assert_token_live`] gate, so a password change AND a sync-device
295	305		/// removal both kill userinfo tokens (the same gate `SyncUser` applies).
296	306		pub struct OAuthUser {
	307	+	/// The authenticated user.
297	308		pub user_id: UserId,
	309	+	/// Scopes granted to this userinfo access token.
298	310		pub scopes: GrantedScopes,
299	311		}
300	312