Struct AuthCtx 

#[non_exhaustive]
pub struct AuthCtx {
    pub users: Arc<dyn UserStore>,
    pub sessions: Arc<dyn SessionStore>,
    pub biscuit: BiscuitConfig,
    pub jwt: Option<JwtConfig>,
    pub oidc: Option<OidcRegistry>,
    pub passkeys: Option<PasskeyManager>,
    pub zanzibar: Option<Arc<dyn ZanzibarStore>>,
    pub oidc_provider: Option<OidcProviderConfig>,
    /* private fields */
}

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

users: Arc<dyn UserStore>

Authoritative user record store. Carries password hashes, upstream-provider links, and passkeys.

sessions: Arc<dyn SessionStore>

Session record store — opaque session id + CSRF token + expiry.

biscuit: BiscuitConfig

Biscuit capability-token issuer + verifier. Foundational (always present): wraps the active root keypair loaded from auth.biscuit_root_keys (or generated on first boot). Used for share links, delegated upload caps, worker capability tokens, edge auth, and any flow that wants offline-verifiable bearer tokens. See crate::biscuit::BiscuitConfig.

jwt: Option<JwtConfig>

JWT issuance/verification configuration. Active key + history; see crate::jwt::JwtConfig. Present only when the auth-jwt feature is enabled.

oidc: Option<OidcRegistry>

Slug-keyed registry of discovered upstream OIDC providers. Engine boot constructs an empty registry; admin CRUD (or seed config) populates it. See crate::oidc::OidcRegistry.

passkeys: Option<PasskeyManager>

WebAuthn / passkey manager. Wraps a single webauthn_rs::Webauthn built from the operator’s RP config. See crate::passkey::PasskeyManager.

zanzibar: Option<Arc<dyn ZanzibarStore>>

Zanzibar / ReBAC permission store. Optional — engine boot wires the appropriate backend (Postgres / SQLite) once the auth schema migration has run. See crate::zanzibar::ZanzibarStore for the trait surface; full Keto/SpiceDB feature parity (recursive CTE walk, expand, lookup_*) lives behind it.

oidc_provider: Option<OidcProviderConfig>

Full OIDC provider — discovery, JWKS, /authorize, /token, /userinfo, /revoke, /introspect, federation. Optional because a deployment may use assay-engine purely as an OIDC client; engine boot constructs the config once the V4 migration has run and the upstream provider rows are loaded into the registry.

Implementations

impl AuthCtx

pub fn new(users: Arc<dyn UserStore>, sessions: Arc<dyn SessionStore>) -> Self

Construct a context from the bare minimum required by phase 4 — user and session stores. Biscuit is initialised with an ephemeral keypair (no DB row) so unit tests + downstream callers that don’t run engine boot can still construct an AuthCtx. Engine boot replaces the biscuit field via AuthCtx::with_biscuit once the persistent root key has been loaded from auth.biscuit_root_keys.

pub fn with_jwt(self, jwt: JwtConfig) -> Self

Replace the JWT configuration. Used by engine boot once the JWKS keys have been loaded from auth.jwks_keys.

pub fn with_external_issuers(self, issuers: Vec<ExternalJwtIssuer>) -> Self

Replace the external-issuer list. Used by engine boot after each issuer’s discovery + initial JWKS fetch completes. The Vec is consumed and stored as Arc<[T]> so subsequent AuthCtx clones share the same slice via refcount.

pub fn external_issuers(&self) -> &[ExternalJwtIssuer]

Read access to the configured external issuers. Used by the auth gate’s JWT pass-through fallthrough.

pub fn with_oidc(self, oidc: OidcRegistry) -> Self

Replace the OIDC registry. Engine boot creates an empty registry for unconfigured deployments; once admin CRUD lands, the same builder runs after the seed providers are loaded.

pub fn with_passkeys(self, passkeys: PasskeyManager) -> Self

Replace the passkey manager. Optional — the manager owns a live webauthn_rs::Webauthn built from the engine’s RP config and is only constructible when that config is present.

pub fn with_biscuit(self, biscuit: BiscuitConfig) -> Self

Replace the biscuit configuration. Engine boot loads the active root key from auth.biscuit_root_keys (or generates one on first boot) and feeds the result here.

pub fn with_zanzibar(self, zanzibar: Arc<dyn ZanzibarStore>) -> Self

Replace the Zanzibar store. Engine boot constructs the appropriate backend impl after the auth schema migration runs; see crates/assay-engine/src/init.rs. Phase 6 only wires the builder + the migration; full AuthCtx composition happens in phase 8 alongside HTTP route mounting.

pub fn with_oidc_provider(self, oidc_provider: OidcProviderConfig) -> Self

Replace the OIDC provider configuration. Engine boot constructs the appropriate stores (PG / SQLite) after the V4 auth schema migration runs; see crates/assay-engine/src/init.rs. only wires the builder + the migrations + the placeholder router; phase 8 weaves the resolved AuthCtx into the actual /authorize and /token HTTP handlers.

Trait Implementations

impl Clone for AuthCtx

fn clone(&self) -> AuthCtx

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl FromRef<AuthCtxWithAdmin> for AuthCtx

fn from_ref(s: &AuthCtxWithAdmin) -> Self

Converts to this type from a reference to the input type.