Module auth_layer

Authentication middleware for the AuthZEN HTTP server.

Modes:

• AuthConfig::Disabled — no auth. Suitable for development or loopback-only deployments. The server refuses to start with Disabled auth on a non-loopback bind unless AGENTGUARD_ALLOW_LOOPBACK_BYPASS=1 is set.
• AuthConfig::ApiKey — Authorization: Bearer <raw> against the configured ApiKeyStore. Argon2id is the verification path; the cost (~150 ms) is acceptable on the auth path.

Health probes (/healthz, /readyz) are always unauthenticated so Kubernetes can poll them without a credential.

Structs

AuthenticatedIdentity

Authenticated identity and tenant asserted by a verified, bound API key.

Enums

AuthLayer

What the auth layer needs to validate requests. Built once at startup and shared across Axum workers.

AuthenticationFailure

Functions

auth_layer_fn

Middleware function. Wire via axum::middleware::from_fn_with_state because the router’s state is needed for the auth layer reference.