feat: remove query param extractor

Author: cmackenzie1

CHANGELOG.md

@@ -11,11 +11,9 @@ All notable changes to this project will be documented in this file.
   - `BearerTokenExtractor` (default): Authorization: Bearer <token>
   - `HeaderTokenExtractor<C>`: Custom HTTP headers
   - `CookieTokenExtractor<C>`: Cookie-based tokens
-  - `QueryTokenExtractor<C>`: Query parameter tokens
 - Added convenience macros to reduce boilerplate:
   - `define_header_extractor!(Name, "header-name")`
   - `define_cookie_extractor!(Name, "cookie-name")`
-  - `define_query_extractor!(Name, "param-name")`
 
 ## [0.5.1] - 2025-04-03
 

README.md

@@ -56,24 +56,22 @@ async fn main() {
 
 - **Local validation**: Validate JWTs with local RSA/HMAC keys
 - **Remote JWKS**: Automatic fetching, caching, and refresh of remote JWKS endpoints
-- **Flexible token extraction**: Bearer tokens (default), custom headers, cookies, or query parameters
+- **Flexible token extraction**: Bearer tokens (default), custom headers or cookies
 - **Type-safe claims**: Strongly-typed claims via generic extractors
 - **Axum integration**: Drop-in extractor for route handlers
 
 ## Custom Token Extractors
 
-Extract tokens from headers, cookies, or query parameters:
+Extract tokens from custom headers or cookies:
 
 ```rust
-use axum_jwt_auth::{define_header_extractor, define_cookie_extractor, define_query_extractor};
+use axum_jwt_auth::{define_header_extractor, define_cookie_extractor};
 
 define_header_extractor!(XAuthToken, "x-auth-token");
 define_cookie_extractor!(AuthCookie, "auth_token");
-define_query_extractor!(TokenParam, "token");
 
 async fn header_auth(user: Claims<MyClaims, HeaderTokenExtractor<XAuthToken>>) { }
 async fn cookie_auth(user: Claims<MyClaims, CookieTokenExtractor<AuthCookie>>) { }
-async fn query_auth(user: Claims<MyClaims, QueryTokenExtractor<TokenParam>>) { }
 ```
 
 ## Examples

src/axum.rs

@@ -75,10 +75,10 @@ impl TokenExtractor for BearerTokenExtractor {
 
 /// Provides configuration values for token extractors.
 ///
-/// Implement this trait to specify custom header names, cookie names, or query parameter names.
+/// Implement this trait to specify custom header names or cookie names
 /// Typically used with the `define_*_extractor!` macros rather than implemented manually.
 pub trait ExtractorConfig {
-    /// Returns the header name, cookie name, or query parameter name to extract from.
+    /// Returns the header name or cookie name to extract from.
     fn value() -> &'static str;
 }
 
@@ -132,31 +132,6 @@ macro_rules! define_cookie_extractor {
     };
 }
 
-/// Creates a custom query parameter token extractor with the given name and parameter value.
-///
-/// # Examples
-///
-/// ```
-/// use axum_jwt_auth::define_query_extractor;
-///
-/// // Define a custom query extractor for "token"
-/// define_query_extractor!(TokenParam, "token");
-///
-/// // Now use it in your handlers:
-/// // async fn handler(user: Claims<MyClaims, QueryTokenExtractor<TokenParam>>) -> Response { ... }
-/// ```
-#[macro_export]
-macro_rules! define_query_extractor {
-    ($name:ident, $param:expr) => {
-        pub struct $name;
-        impl $crate::ExtractorConfig for $name {
-            fn value() -> &'static str {
-                $param
-            }
-        }
-    };
-}
-
 /// Extracts JWT tokens from a custom HTTP header.
 ///
 /// Use with the `define_header_extractor!` macro for convenience.
@@ -214,39 +189,6 @@ impl<C: ExtractorConfig> TokenExtractor for CookieTokenExtractor<C> {
     }
 }
 
-/// Extracts JWT tokens from a URL query parameter.
-///
-/// Use with the `define_query_extractor!` macro for convenience.
-///
-/// # Example
-///
-/// ```ignore
-/// define_query_extractor!(TokenParam, "token");
-///
-/// async fn handler(user: Claims<MyClaims, QueryTokenExtractor<TokenParam>>) {
-///     // Token extracted from the "?token=..." query parameter
-/// }
-/// ```
-pub struct QueryTokenExtractor<C: ExtractorConfig>(PhantomData<C>);
-
-#[async_trait]
-impl<C: ExtractorConfig> TokenExtractor for QueryTokenExtractor<C> {
-    async fn extract_token(parts: &mut Parts) -> Result<String, AuthError> {
-        let query_string = parts.uri.query().ok_or(AuthError::MissingToken)?;
-
-        // Parse query parameters manually
-        for pair in query_string.split('&') {
-            if let Some((key, value)) = pair.split_once('=') {
-                if key == C::value() {
-                    return Ok(value.to_string());
-                }
-            }
-        }
-
-        Err(AuthError::MissingToken)
-    }
-}
-
 impl<S, T, E> axum::extract::FromRequestParts<S> for Claims<T, E>
 where
     JwtDecoderState<T>: FromRef<S>,
@@ -411,12 +353,6 @@ mod tests {
         assert_eq!(TestCookie::value(), "test_cookie");
     }
 
-    #[test]
-    fn test_query_extractor_macro() {
-        define_query_extractor!(TestQuery, "test_param");
-        assert_eq!(TestQuery::value(), "test_param");
-    }
-
     // ============================================================================
     // Error Mapping Tests
     // ============================================================================
@@ -789,145 +725,6 @@ mod tests {
         assert_eq!(token.unwrap(), "my_jwt_token");
     }
 
-    // ============================================================================
-    // QueryTokenExtractor Tests
-    // ============================================================================
-
-    #[tokio::test]
-    async fn test_query_token_extractor_valid() {
-        define_query_extractor!(TokenParam, "token");
-        type TokenParamExtractor = QueryTokenExtractor<TokenParam>;
-
-        let req = Request::builder()
-            .uri("http://example.com/api?token=my_jwt_token&other=value")
-            .body(Body::empty())
-            .unwrap();
-
-        let token = TokenParamExtractor::extract_token(&mut req.into_parts().0).await;
-        assert!(token.is_ok());
-        assert_eq!(token.unwrap(), "my_jwt_token");
-    }
-
-    #[tokio::test]
-    async fn test_query_token_extractor_single_param() {
-        define_query_extractor!(TokenParam2, "token");
-        type TokenParamExtractor = QueryTokenExtractor<TokenParam2>;
-
-        let req = Request::builder()
-            .uri("http://example.com/api?token=my_jwt_token")
-            .body(Body::empty())
-            .unwrap();
-
-        let token = TokenParamExtractor::extract_token(&mut req.into_parts().0).await;
-        assert!(token.is_ok());
-        assert_eq!(token.unwrap(), "my_jwt_token");
-    }
-
-    #[tokio::test]
-    async fn test_query_token_extractor_missing_parameter() {
-        define_query_extractor!(TokenParam3, "token");
-        type TokenParamExtractor = QueryTokenExtractor<TokenParam3>;
-
-        let req = Request::builder()
-            .uri("http://example.com/api?other=value")
-            .body(Body::empty())
-            .unwrap();
-        let token = TokenParamExtractor::extract_token(&mut req.into_parts().0).await;
-        assert!(token.is_err());
-        assert_eq!(token.unwrap_err(), AuthError::MissingToken);
-    }
-
-    #[tokio::test]
-    async fn test_query_token_extractor_no_query_string() {
-        define_query_extractor!(TokenParam4, "token");
-        type TokenParamExtractor = QueryTokenExtractor<TokenParam4>;
-
-        let req = Request::builder()
-            .uri("http://example.com/api")
-            .body(Body::empty())
-            .unwrap();
-        let token = TokenParamExtractor::extract_token(&mut req.into_parts().0).await;
-        assert!(token.is_err());
-        assert_eq!(token.unwrap_err(), AuthError::MissingToken);
-    }
-
-    #[tokio::test]
-    async fn test_query_token_extractor_empty_value() {
-        define_query_extractor!(TokenParam5, "token");
-        type TokenParamExtractor = QueryTokenExtractor<TokenParam5>;
-
-        let req = Request::builder()
-            .uri("http://example.com/api?token=")
-            .body(Body::empty())
-            .unwrap();
-
-        let token = TokenParamExtractor::extract_token(&mut req.into_parts().0).await;
-        assert!(token.is_ok());
-        assert_eq!(token.unwrap(), "");
-    }
-
-    #[tokio::test]
-    async fn test_query_token_extractor_multiple_params() {
-        define_query_extractor!(TokenParam6, "token");
-        type TokenParamExtractor = QueryTokenExtractor<TokenParam6>;
-
-        let req = Request::builder()
-            .uri("http://example.com/api?user=john&token=my_jwt&format=json")
-            .body(Body::empty())
-            .unwrap();
-
-        let token = TokenParamExtractor::extract_token(&mut req.into_parts().0).await;
-        assert!(token.is_ok());
-        assert_eq!(token.unwrap(), "my_jwt");
-    }
-
-    #[tokio::test]
-    async fn test_query_token_extractor_url_encoded() {
-        define_query_extractor!(TokenParam7, "token");
-        type TokenParamExtractor = QueryTokenExtractor<TokenParam7>;
-
-        let req = Request::builder()
-            .uri("http://example.com/api?token=value%2Bwith%2Bplus")
-            .body(Body::empty())
-            .unwrap();
-
-        let token = TokenParamExtractor::extract_token(&mut req.into_parts().0).await;
-        assert!(token.is_ok());
-        assert_eq!(token.unwrap(), "value%2Bwith%2Bplus");
-    }
-
-    #[tokio::test]
-    async fn test_query_token_extractor_partial_match() {
-        define_query_extractor!(TokenParam8, "token");
-        type TokenParamExtractor = QueryTokenExtractor<TokenParam8>;
-
-        // Should not match "refresh_token" when looking for "token"
-        let req = Request::builder()
-            .uri("http://example.com/api?refresh_token=my_jwt")
-            .body(Body::empty())
-            .unwrap();
-
-        let token = TokenParamExtractor::extract_token(&mut req.into_parts().0).await;
-        assert!(token.is_err());
-        assert_eq!(token.unwrap_err(), AuthError::MissingToken);
-    }
-
-    #[tokio::test]
-    async fn test_query_token_extractor_first_occurrence() {
-        define_query_extractor!(TokenParam9, "token");
-        type TokenParamExtractor = QueryTokenExtractor<TokenParam9>;
-
-        // If token appears multiple times, should get the first one
-        let req = Request::builder()
-            .uri("http://example.com/api?token=first&other=value&token=second")
-            .body(Body::empty())
-            .unwrap();
-
-        let token = TokenParamExtractor::extract_token(&mut req.into_parts().0).await;
-        assert!(token.is_ok());
-        assert_eq!(token.unwrap(), "first");
-    }
-
     // ============================================================================
     // AuthError IntoResponse Tests
     // ============================================================================

src/lib.rs

@@ -5,7 +5,7 @@
 //! - Automatically fetch and cache remote JWKS endpoints
 //! - Integrate seamlessly with the Axum web framework
 //! - Handle token validation with configurable options
-//! - Extract tokens from multiple sources (headers, cookies, query parameters)
+//! - Extract tokens from multiple sources (headers or cookies)
 //!
 //! It builds on top of the `jsonwebtoken` crate to provide higher-level authentication primitives
 //! while maintaining full compatibility with standard JWT implementations.
@@ -35,13 +35,12 @@
 //! Use macros to easily define custom extractors:
 //!
 //! ```ignore
-//! use axum_jwt_auth::{define_header_extractor, define_cookie_extractor, define_query_extractor};
-//! use axum_jwt_auth::{Claims, HeaderTokenExtractor, CookieTokenExtractor, QueryTokenExtractor};
+//! use axum_jwt_auth::{define_header_extractor, define_cookie_extractor};
+//! use axum_jwt_auth::{Claims, HeaderTokenExtractor, CookieTokenExtractor};
 //!
 //! // Define custom extractors
 //! define_header_extractor!(XAuthToken, "x-auth-token");
 //! define_cookie_extractor!(AuthCookie, "auth_token");
-//! define_query_extractor!(TokenParam, "token");
 //!
 //! // Use in handlers
 //! async fn header_handler(user: Claims<MyClaims, HeaderTokenExtractor<XAuthToken>>) {
@@ -51,10 +50,6 @@
 //! async fn cookie_handler(user: Claims<MyClaims, CookieTokenExtractor<AuthCookie>>) {
 //!     // Token extracted from "auth_token" cookie
 //! }
-//!
-//! async fn query_handler(user: Claims<MyClaims, QueryTokenExtractor<TokenParam>>) {
-//!     // Token extracted from "?token=..." query parameter
-//! }
 //! ```
 //!
 //! # Examples
@@ -74,7 +69,7 @@ use thiserror::Error;
 
 pub use crate::axum::{
     AuthError, BearerTokenExtractor, Claims, CookieTokenExtractor, ExtractorConfig,
-    HeaderTokenExtractor, JwtDecoderState, QueryTokenExtractor, TokenExtractor,
+    HeaderTokenExtractor, JwtDecoderState, TokenExtractor,
 };
 pub use crate::local::LocalDecoder;
 pub use crate::remote::{