Struct IdentityGate 

pub struct IdentityGate { /* private fields */ }

The IdentityGate is the single object main.rs interacts with. It owns the provider registry, the signed proof cache, and (lazily) the local callback server.

Construction is cheap (loads config, opens cache file, generates or loads the signing key). The callback server is not spun up until the first [IdentityGate::start_challenge] call – shields that never hit an identity-gated rule pay zero runtime cost.

Implementations

impl IdentityGate

pub fn new( config: IdentityConfig, providers: Vec<Arc<dyn IdentityProvider>>, state_dir: PathBuf, ) -> Result<Self>

Build a gate from a config and a list of provider implementations. Cache key + signing keypair live in <state_dir> (typically ~/.aperion-shield).

pub fn cached_proof_for(&self, req: &Requirement) -> Option<Proof>

Look up a cached proof satisfying req. None means we have to prompt the user.

pub fn provider(&self, id: &str) -> Option<Arc<dyn IdentityProvider>>

Provider with the given id, or None.

pub async fn callback_base(&self) -> Result<String>

Ensure the callback server is running and return its base URL (e.g. http://127.0.0.1:53201).

pub async fn register_inflight( &self, challenge: &Challenge, requirement: Requirement, provider: String, rule_id: String, ) -> Result<()>

Hand the gate a freshly-minted challenge so the callback server can correlate the user’s redirect back to its in-flight state.

pub async fn wait_for_proof( &self, req: &Requirement, hold_seconds: u64, ) -> Option<Proof>

Block up to hold_seconds waiting for a proof to land in the cache for req. Returns the proof if one arrives; None on timeout. Callers should treat None as “tell the agent to retry”.

pub fn mint_and_cache( &self, vi: &VerifiedIdentity, req: &Requirement, ) -> Result<Proof>

Persist a freshly-verified identity as a signed proof.

pub fn cached_count(&self) -> usize

Number of valid (signature-verified, non-expired) proofs cached.

pub fn flush(&self) -> Result<usize>

Drop every cached proof. Returns how many were evicted.

pub fn hold_seconds(&self) -> u64

Hold seconds configured for this gate.

pub fn has_ready_provider(&self) -> bool

True if at least one provider is registered AND ready.

pub fn config(&self) -> &IdentityConfig

Read-only access to the loaded config.