Enum AuthLayer

pub enum AuthLayer {
    Disabled,
    ApiKey(Arc<ApiKeyStore>),
    ReloadableApiKey {
        store: Arc<ApiKeyStore>,
        path: PathBuf,
    },
}

What the auth layer needs to validate requests. Built once at startup and shared across Axum workers.

Variants

Disabled

ApiKey(Arc<ApiKeyStore>)

ReloadableApiKey

Fields

store: Arc<ApiKeyStore>

path: PathBuf

Implementations

impl AuthLayer

pub fn from_config( cfg: &AuthConfig, allow_loopback_bypass: bool, ) -> Result<Self, String>

Build from the configured mode.

pub fn reloadable_key_store(&self) -> Option<(PathBuf, Arc<ApiKeyStore>)>

Return the key-store source used by the standalone lifecycle so it can watch and atomically reload operator rotations/revocations.

pub fn authenticate_bearer( &self, authorization: Option<&str>, required_scope: &str, require_identity: bool, ) -> Result<Option<AuthenticatedIdentity>, AuthenticationFailure>

Authenticate non-HTTP transports using the same scope and identity requirements as the AuthZEN HTTP endpoints.

pub async fn authenticate_bearer_async( &self, authorization: Option<&str>, required_scope: &str, require_identity: bool, ) -> Result<Option<AuthenticatedIdentity>, AuthenticationFailure>

Authenticate without running the memory-hard hash on a Tokio worker. Saturation fails fast so hostile traffic cannot build an unbounded queue of expensive password-hash jobs.

Trait Implementations

impl Clone for AuthLayer

fn clone(&self) -> AuthLayer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.