Module auth 

Read authentication (RFC-ACDP-0008 §6.2, 0.5.0 bearer_jwt).

A registry that serves non-public contexts, or that sets anonymous_public_reads: false, answers an unauthenticated read with not_authorized. Revocation discovery against such a vantage is then unknown (unanswerable), never not-revoked. An AuthProvider attached to a RegistryClient or a CrossRegistryResolver makes those reads answerable by presenting Authorization: Bearer <token> (RFC 6750).

The provider is asked for a token per request, by authority — the host (plus non-default port) of the registry being read. A bearer_jwt token’s aud is the registry that minted it, and that registry MUST reject any other audience; asking by authority keeps one registry’s token from ever being presented to another, including on a cross-registry walk. Minting the token (the signed-challenge exchange) is deployment-defined and outside the protocol, so it is the provider’s job; this crate only presents what the provider returns.

Tokens are attached only to read requests (retrieve, lineage, current, search), only over https, and never on a redirect to another authority (the client follows same-authority redirects only). A bearer token never substitutes for a producer signature on a write (RFC-ACDP-0008 §6.2), so publish* never sends one, and neither does the public capabilities fetch.

Structs

BearerToken

A bearer token. Debug and Display never print it.

PerAuthorityTokens

A token per authority, replaceable at runtime — the shape a CrossRegistryResolver walk across several registries needs. Cheap to clone (an Arc handle); a clone shares the table, so a background task can refresh tokens with Self::set while readers use them.

StaticBearerToken

One token for exactly one authority. Use on a RegistryClient that talks to a single registry.

Traits

AuthProvider

Supplies read credentials per registry authority (RFC-ACDP-0008 §6.2).

Type Aliases

AuthFuture

The boxed future an AuthProvider returns. Boxed because the trait is used as dyn AuthProvider and the MSRV (1.86) has no async fn in object-safe traits.