Module auth 

Auth access checks.

This bucket includes:

• caller identity checks (controller/whitelist)
• topology checks (parent/child/root/same canister)
• registry-based role checks
• delegated token verification

Security invariants for delegated tokens:

• Delegated tokens are only valid if their proof matches the currently stored delegation proof.
• Delegation rotation invalidates all previously issued delegated tokens.
• All temporal validation (iat/exp/now) is enforced before access is granted.

Functions

authenticated

Verify a delegated token read from the ingress payload.

has_role

Require that the caller is registered with the expected canister role.

is_child

Require that the caller is a direct child of the current canister.

is_controller

Require that the caller controls the current canister. Allows controller-only maintenance calls.

is_parent

Require that the caller is the configured parent canister.

is_registered_to_subnet

Ensure the caller matches the app directory entry recorded for role. Require that the caller is registered as a canister on this subnet.

is_root

Require that the caller equals the configured root canister.

is_same_canister

Require that the caller is the currently executing canister.

is_whitelisted

Require that the caller appears in the active whitelist (IC deployments). No-op on local builds; enforces whitelist on IC.

Type Aliases

Role