slim_config/
auth.rs

1// Copyright AGNTCY Contributors (https://github.com/agntcy)
2// SPDX-License-Identifier: Apache-2.0
3
4pub mod app_auth;
5pub mod basic;
6pub mod identity;
7pub mod jwt;
8pub mod oidc;
9#[cfg(not(target_family = "windows"))]
10pub mod spire;
11pub mod static_jwt;
12
13pub use app_auth::AuthConfig;
14
15use std::path::PathBuf;
16
17use schemars::JsonSchema;
18use serde::{Deserialize, Serialize};
19
20/// Policy evaluated against JWT claims on every authenticated request.
21///
22/// YAML shape (externally tagged — use exactly one key):
23/// ```yaml
24/// policy:
25///   rego: |
26///     package slim.auth
27///     default allow = false
28///     allow if "admin" in input.claims.groups
29///
30/// policy:
31///   rego_file: /etc/slim/auth.rego
32///
33/// policy:
34///   cel: '"admin" in claims.groups'
35/// ```
36#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, JsonSchema)]
37#[serde(rename_all = "snake_case")]
38pub enum PolicyConfig {
39    /// Inline Rego policy. Must define `package slim.auth` with `default allow = false`.
40    /// Claims available as `input.claims.*`.
41    Rego(String),
42    /// Path to a `.rego` file read at server startup.
43    RegoFile(PathBuf),
44    /// CEL expression that must evaluate to `true`.
45    /// Claims available as `claims.*` (e.g. `"admin" in claims.groups`).
46    Cel(String),
47}
48
49use slim_auth::errors::AuthError as SlimAuthError;
50
51use thiserror::Error;
52
53#[derive(Error, Debug)]
54pub enum ConfigAuthError {
55    // Configuration
56    #[error("username cannot be empty")]
57    AuthBasicEmptyUsername,
58    #[error("password cannot be empty")]
59    AuthBasicEmptyPassword,
60
61    #[error("client id cannot be empty")]
62    AuthOidcEmptyClientId,
63    #[error("client secret cannot be empty")]
64    AuthOidcEmptyClientSecret,
65
66    // App auth validation
67    #[error("auth.secret cannot be empty for shared_secret")]
68    AuthSecretEmpty,
69    #[error("auth.socket_path must be set for spire")]
70    AuthSpireSocketPathMissing,
71
72    // Propagated auth library errors
73    #[error("internal auth error")]
74    AuthInternalError(#[from] SlimAuthError),
75
76    // Verifier errors
77    #[error("audience required")]
78    AuthJwtAudienceRequired,
79
80    // Identity config errors
81    #[error("no identity provider configured")]
82    IdentityProviderNotConfigured,
83    #[error("no identity verifier configured")]
84    IdentityVerifierNotConfigured,
85}
86
87pub trait ClientAuthenticator {
88    // associated types
89    type ClientLayer;
90
91    fn get_client_layer(&self) -> Result<Self::ClientLayer, ConfigAuthError>;
92}
93
94pub trait ServerAuthenticator<Response: Default> {
95    // associated types
96    type ServerLayer;
97
98    fn get_server_layer(&self) -> Result<Self::ServerLayer, ConfigAuthError>;
99}
slim_config/auth.rs

slim_config/
auth.rs
