Struct BearerTokenTenantResolver 

pub struct BearerTokenTenantResolver { /* private fields */ }

Extracts a tenant ID from the Authorization: Bearer <token> header.

Use with_mapper; new is for tests

new uses the raw, unverified bearer token as the tenant identifier. No signature is checked and no expiry is honoured, so the tenant is a string the caller chose — which is the same as having no tenancy, and worse, because it looks like having some.

with_mapper is the constructor for a deployment: give it a closure that verifies the token (checks the signature, checks expiry) and returns the tenant claim, or None to reject. The mapper is where the trust in this module’s security section is established or is not.

Example

use a2a_protocol_server::tenant_resolver::BearerTokenTenantResolver;

// Use the raw token as tenant ID:
let resolver = BearerTokenTenantResolver::new();

// With a custom mapping:
let resolver = BearerTokenTenantResolver::with_mapper(|token| {
    // e.g. decode JWT, look up tenant in cache, etc.
    Some(format!("tenant-for-{token}"))
});

Implementations

impl BearerTokenTenantResolver

pub fn new() -> Self

Creates a resolver that uses the raw bearer token as the tenant ID.

pub fn with_mapper<F>(mapper: F) -> Self

where F: Fn(&str) -> Option<String> + Send + Sync + 'static,

Creates a resolver with a custom mapping function.

The mapper receives the bearer token (without the Bearer prefix) and returns an optional tenant ID. Return None to indicate that the token does not map to a valid tenant.

Trait Implementations

impl Debug for BearerTokenTenantResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for BearerTokenTenantResolver

fn default() -> Self

Returns the “default value” for a type.

impl TenantResolver for BearerTokenTenantResolver

fn resolve<'a>( &'a self, ctx: &'a CallContext, ) -> Pin<Box<dyn Future<Output = Option<String>> + Send + 'a>>

Extracts the tenant identifier from the given call context.