Trait AuthPlugin 

pub trait AuthPlugin<S: AuthSchema>: Send + Sync {
    // Required methods
    fn name(&self) -> &'static str;
    fn routes(&self) -> Vec<AuthRoute>;
    fn on_request<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        req: &'life1 AuthRequest,
        ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait;

    // Provided methods
    fn rate_limits(&self) -> Vec<PluginRateLimit> { ... }
    fn server_endpoints(&self) -> Vec<EndpointDefinition> { ... }
    fn endpoint_hooks(&self) -> Vec<&dyn EndpointHook<S>> { ... }
    fn validate_endpoint(
        &self,
        call: &EndpointCall,
        _ctx: &AuthContext<S>,
    ) -> AuthResult<EndpointInput> { ... }
    fn on_endpoint<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        _call: &'life1 EndpointCall,
        _ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<EndpointResponse>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn allowed_media_types(&self, _route: &AuthRoute) -> Vec<&'static str> { ... }
    fn origin_check_skip_paths(&self) -> Vec<&'static str> { ... }
    fn session_fields(&self) -> IndexMap<String, FieldConfig> { ... }
    fn user_fields(&self) -> FieldConfigs { ... }
    fn account_fields(&self) -> FieldConfigs { ... }
    fn openapi_metadata(
        &self,
        _ctx: &AuthInitContext<S>,
    ) -> PluginOpenApiMetadata { ... }
    fn static_openapi_metadata(&self) -> PluginOpenApiMetadata { ... }
    fn on_init<'life0, 'life1, 'async_trait>(
        &'life0 self,
        _ctx: &'life1 mut AuthInitContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
    fn on_http_request<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        _req: &'life1 AuthRequest,
        _ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn on_http_request_action<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        req: &'life1 AuthRequest,
        ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<Option<HttpRequestAction>>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn on_http_response<'life0, 'life1, 'life2, 'life3, 'async_trait>(
        &'life0 self,
        _req: &'life1 AuthRequest,
        _ctx: &'life2 AuthContext<S>,
        _response: &'life3 AuthResponse,
    ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait,
             'life3: 'async_trait { ... }
    fn before_request<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        _req: &'life1 AuthRequest,
        _ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<Option<BeforeRequestAction>>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn on_http_endpoint<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        req: &'life1 AuthRequest,
        ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<Option<HttpEndpointResponse>>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn after_request<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        _req: &'life1 AuthRequest,
        _ctx: &'life2 AuthContext<S>,
        response: AuthResponse,
    ) -> Pin<Box<dyn Future<Output = AuthResult<AuthResponse>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn on_user_created<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        _user: &'life1 S::User,
        _ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn on_session_created<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        _session: &'life1 S::Session,
        _ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn on_user_deleted<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        _user_id: &'life1 str,
        _ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
    fn on_session_deleted<'life0, 'life1, 'life2, 'async_trait>(
        &'life0 self,
        _session_token: &'life1 str,
        _ctx: &'life2 AuthContext<S>,
    ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait,
             'life2: 'async_trait { ... }
}

Plugin trait that all authentication plugins must implement.

Required Methods

fn name(&self) -> &'static str

Plugin name - should be unique

fn routes(&self) -> Vec<AuthRoute>

Routes that this plugin handles

fn on_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each request - return Some(response) to handle, None to pass through

Provided Methods

fn rate_limits(&self) -> Vec<PluginRateLimit>

Ordered rate-limit policies supplied by this installed plugin.

fn server_endpoints(&self) -> Vec<EndpointDefinition>

Trusted operations available through host dispatch, independently of HTTP visibility.

fn endpoint_hooks(&self) -> Vec<&dyn EndpointHook<S>>

Installed logical-call hooks, in this plugin’s registration order.

fn validate_endpoint( &self, call: &EndpointCall, _ctx: &AuthContext<S>, ) -> AuthResult<EndpointInput>

Validate actual input after all before-hook patches have been applied.

Errors

Returns an intentional validation error, which completed hooks can observe.

fn on_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _call: &'life1 EndpointCall, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<EndpointResponse>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Execute a registered operation with validated handler-phase context.

Errors

Returns the operation’s actual API or application failure.

fn allowed_media_types(&self, _route: &AuthRoute) -> Vec<&'static str>

Media types accepted before request hooks and endpoint dispatch. An empty list disables the media restriction for an application-owned endpoint.

fn origin_check_skip_paths(&self) -> Vec<&'static str>

Protocol callback prefixes whose verified state replaces browser origin admission.

fn session_fields(&self) -> IndexMap<String, FieldConfig>

Session field policies contributed by this registered plugin.

fn user_fields(&self) -> FieldConfigs

fn account_fields(&self) -> FieldConfigs

fn openapi_metadata(&self, _ctx: &AuthInitContext<S>) -> PluginOpenApiMetadata

Documentation annotations collected after all plugins initialize. Override this hook for custom endpoints and model field policies.

fn static_openapi_metadata(&self) -> PluginOpenApiMetadata

Base declarations for documentation without an initialized auth instance.

fn on_init<'life0, 'life1, 'async_trait>( &'life0 self, _ctx: &'life1 mut AuthInitContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called when the plugin is initialized

fn on_http_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Inspect the original physical HTTP request before routing, body parsing, origin validation and endpoint hooks. Disabled paths and transport/rate limiting middleware run first. Returning a response stops dispatch and later plugin hooks. Server-only endpoint calls do not invoke this hook.

fn on_http_request_action<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<HttpRequestAction>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Inspect or replace the physical request. The default preserves existing on_http_request implementations. Request-local configuration has already been resolved from the incoming request, matching the Source HTTP handler.

fn on_http_response<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, _response: &'life3 AuthResponse, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Observe the routed HTTP response before transport middleware (including CORS). Hooks run in registration order; the first replacement stops this chain. Early HTTP request-hook responses skip this stage. Errors escape dispatch; they cannot reverse writes already committed by an endpoint.

fn before_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<BeforeRequestAction>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called after route matching and before endpoint dispatch.

Return Some(BeforeRequestAction::Respond(..)) to short-circuit with a response, Some(BeforeRequestAction::InjectSession { .. }) to attach a virtual session (e.g. API-key → session emulation), Some(BeforeRequestAction::ReplaceHeaders { .. }) to transform request headers, or None to continue endpoint dispatch.

fn on_http_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<HttpEndpointResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Dispatch the resolved HTTP endpoint. Existing plugins return logical values through on_request; plugins returning a native raw response can override this method to bypass the endpoint after-hook pipeline.

fn after_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, response: AuthResponse, ) -> Pin<Box<dyn Future<Output = AuthResult<AuthResponse>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Transform a completed response, including redirects and rejections.

Hooks run in plugin registration order with the normalized auth path. This supports cookie and header lifecycles that span other plugins.

fn on_user_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user: &'life1 S::User, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called after a user is created

fn on_session_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session: &'life1 S::Session, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called after a session is created

fn on_user_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user_id: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called before a user is deleted

fn on_session_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session_token: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called before a session is deleted

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors