Struct Auth 

pub struct Auth {

    pub kind: AuthKind,
    pub issuer: Option<String>,
    pub token_url: Option<String>,
    pub device_authorization_url: Option<String>,
    pub authorization_url: Option<String>,
    pub client_id: Option<String>,
    pub client_secret: Option<Secret>,
    pub grant: Option<OAuthGrant>,
    pub scopes: Vec<String>,
    pub audience: Option<String>,
    pub token: Option<Secret>,
    pub header: Option<String>,
    pub value: Option<Secret>,
    pub region: Option<String>,
    pub service: Option<String>,
    pub source: Option<String>,
    pub sso_start_url: Option<String>,
    pub account_id: Option<String>,
    pub role_name: Option<String>,
    pub svid: Option<String>,
    pub jwt_svid_file: Option<String>,
    pub svid_file: Option<String>,
    pub key_file: Option<String>,
}

A unified per-endpoint authentication provider (RFC 0031 §5). A flat, kind-discriminated record: only the fields relevant to the chosen kind are set; semantic validation (§14) enforces which are required. The provider kinds land incrementally — static/oauth2 first, then aws/spiffe.

Fields

kind: AuthKind

issuer: Option<String>

Issuer base URL for .well-known metadata discovery (RFC 8414 / OIDC), used to fill the token / device-authorization endpoints when unset.

token_url: Option<String>

device_authorization_url: Option<String>

authorization_url: Option<String>

client_id: Option<String>

client_secret: Option<Secret>

A confidential client’s secret ({{secret:…}}); omit for a public client (the device grant needs no secret).

grant: Option<OAuthGrant>

device (default, interactive), authorization_code, or client_credentials (headless M2M).

scopes: Vec<String>

audience: Option<String>

token: Option<Secret>

A static bearer ({{secret:…}}) → Authorization: Bearer ….

header: Option<String>

A static credential under an arbitrary header name (paired with value).

value: Option<Secret>

region: Option<String>

service: Option<String>

The AWS service to sign for (e.g. bedrock, execute-api).

source: Option<String>

The credential source: env / static / sso (IAM Identity Center interactive login → temporary credentials). (imds/irsa are follow-ups.)

sso_start_url: Option<String>

aws source: sso — the IAM Identity Center portal start URL, the account, and the permission-set role to assume (via agentd login).

account_id: Option<String>

role_name: Option<String>

svid: Option<String>

The SVID type: jwt (a rotating JWT-SVID bearer, the file-SVID MVP) or x509 (mTLS — a follow-up).

jwt_svid_file: Option<String>

Path to the SPIRE-written JWT-SVID token file (re-read per request, so a rotation is picked up).

svid_file: Option<String>

Paths to the X.509-SVID cert + key (for svid: x509).

key_file: Option<String>

Implementations

impl Auth

pub fn to_spec(&self) -> AuthSpec

Lower to the secret-free runtime AuthSpec (spawn payload). Secrets stay as {{secret:…}} templates.

Trait Implementations

impl Clone for Auth

fn clone(&self) -> Auth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Auth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Auth

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Auth

fn eq(&self, other: &Auth) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Auth