Struct Gate 

pub struct Gate;

Main entry point for creating authentication gates.

Gates protect your axum routes from unauthorized access using JWT tokens. All requests are denied by default unless explicitly granted access through an access policy. Choose between cookie-based gates for web applications and bearer token gates for APIs and SPAs.

Implementations

impl Gate

pub fn cookie<C, R, G>(issuer: &str, codec: Arc<C>) -> CookieGate<C, R, G>

where C: Codec, R: AccessHierarchy + Eq + Display, G: Eq,

Creates a new cookie-based gate that denies all access by default.

Use this for web applications where you want automatic token handling through HTTP-only cookies. Cookie gates provide CSRF protection and work seamlessly with browser-based authentication flows.

Attach an access policy using with_policy() to grant access. This secure-by-default approach ensures no routes are exposed until you explicitly configure a policy.

Arguments

• issuer - The JWT issuer identifier for your application
• codec - JWT codec for encoding/decoding tokens

Example

let jwt_codec = Arc::new(JsonWebToken::<JwtClaims<Account<Role, Group>>>::default());
let policy = AccessPolicy::<Role, Group>::require_role(Role::Admin);

let gate = Gate::cookie("my-app", jwt_codec)
    .with_policy(policy);

pub fn bearer<C, R, G>( issuer: &str, codec: Arc<C>, ) -> BearerGate<C, R, G, JwtConfig<R, G>>

where C: Codec, R: AccessHierarchy + Eq + Display, G: Eq + Clone,

Creates a new bearer-header based gate that denies all access by default.

Use this for APIs, SPAs, and mobile applications where you need explicit token management. Bearer token gates require clients to include tokens in the Authorization: Bearer <token> header, providing fine-grained control over token lifecycle and excellent support for API integrations.

This variant protects routes by expecting an Authorization: Bearer <token> header. Missing or invalid bearer tokens result in 401 Unauthorized.

Optional mode is supported via allow_anonymous_with_optional_user(). In optional mode, requests are always forwarded and the layer inserts Option<Account<R, G>> and Option<RegisteredClaims> (Some only when the token is valid). You can also transition to a static shared-secret mode via .with_static_token("...").

Arguments

• issuer - The JWT issuer identifier for your application
• codec - JWT codec for encoding/decoding tokens

pub fn oauth2<R, G>() -> OAuth2Gate<R, G>

where R: AccessHierarchy + Eq + Display + Send + Sync + 'static, G: Eq + Clone + Send + Sync + 'static,

Creates a new OAuth2-based gate builder using the oauth2 crate.

This returns an OAuth2 flow builder that can mount /login and /callback routes and, on successful callback, will mint a first-party JWT via the existing CookieGate.

pub fn oauth2_with_jwt<C, R, G>( issuer: &str, codec: Arc<C>, ttl_secs: u64, ) -> OAuth2Gate<R, G>

where C: Codec<Payload = JwtClaims<Account<R, G>>> + Send + Sync + 'static, R: AccessHierarchy + Eq + Display + Send + Sync + 'static, G: Eq + Clone + Send + Sync + 'static,

Creates a new OAuth2-based gate builder preconfigured with a JWT encoder.

Arguments

• issuer - JWT issuer for your application
• codec - JWT codec used to mint tokens for the first‑party cookie
• ttl_secs - Expiration (seconds) for issued JWTs

Trait Implementations

impl Clone for Gate

fn clone(&self) -> Gate

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.