Struct Auth 

pub struct Auth { /* private fields */ }

Control-plane auth configuration: the token trust anchor (root public key) plus the KV that holds the RBAC policy (authz/policy) and revocation markers (authz/revoked/<id>). None ⇒ auth disabled (development).

Implementations

impl Auth

pub fn disabled() -> Self

No authentication (development default).

pub fn with_key(public: TokenPublicKey, kv: Arc<dyn KvStore>) -> Self

Enable token auth: verify tokens against the root public key public, and read the RBAC policy + revocation markers from kv (front it with the shared CachedKv so policy reads are cheap and ride cache invalidation).

pub fn with_pop(self, pop_origin: Option<String>, require_pop: bool) -> Self

Configure per-request proof-of-possession enforcement (DPoP): the fleet’s canonical origin a proof must bind (pop_origin, the proof aud) and whether every token must be holder-bound (require_pop). A no-op when auth is disabled. A holder-bound (cnf) token always requires a valid proof regardless of require_pop.

pub fn is_disabled(&self) -> bool

Whether no authentication is configured.

pub fn public_key(&self) -> Option<TokenPublicKey>

The root public key (verification trust anchor), when auth is enabled — so a self-service handler like whoami can verify the presented token.

pub async fn verify_bearer(&self, bearer: &str) -> bool

The “any valid token” gate (protected previews): a token that is authentic, unexpired, and not revoked — no RBAC right required. Returns false when auth is disabled (no tokens exist to present).

pub async fn classify_channel_bearer(&self, bearer: &str) -> ChannelBearer

Classify a bearer for a session-channel gate (the HTTP /mcp endpoint): a channel authenticates once, then re-authorizes each operation per call, so it needs a valid plain bearer. A holder-bound (cnf) token can’t produce a per-request PoP proof for the in-process calls, so it’s reported distinctly (the gate rejects it with a clear message rather than letting every tool call fail an opaque PoP check).

pub async fn verify_join_token( &self, token: &str, now: u64, ) -> Result<String, TokenError>

Verify a mesh join token against the primary root, then — on failure — the replicated rotation anchor set, returning its single-use jti. Because the anchor set is operator-managed (auth rotate-root), a cluster can mint join tokens with a distinct mesh-admission key trusted alongside (not instead of) the admin-token root — narrowing the admission blast radius (F8) without a separate signer config or imposing KMS. Err when auth is disabled or the token verifies under no trusted anchor.

pub async fn verify_bearer_roles( &self, bearer: &str, ) -> Option<Vec<GrantedRole>>

Like verify_bearer, but returns the token’s granted roles on success. whoami uses this so it reports an identity only for a token that is authentic, unexpired, and unrevoked — not for any signature-valid blob. None when auth is disabled or any check fails.

Trait Implementations

impl Clone for Auth

fn clone(&self) -> Auth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for Auth

fn default() -> Auth

Returns the “default value” for a type.