Module door_auth 

Who may call the A2A door: the tokens a capsule declaring network.authentication mints at launch, the check every gated request passes, and the refusals it answers with.

A token is a pure bearer token. It is a crate::mac_token token of the family DOOR_TOKEN_TAG, sealed with a MintKey generated in memory for one session and bound to nothing, so holding it is the whole of what a caller must do. That is what lets a standard A2A client given a token call the door. Its payload is {"credential": "<name>", "scopes": [...]}. The key is never written anywhere, so a token dies with the session that minted it and a restart mints new ones. There is no revocation list: dropping the key revokes every token.

The operator token always exists. It holds every scope in DOOR_SCOPES. Each credential the manifest declares mints one more token, carrying exactly that credential’s scopes, so a declared credential exists to hand out less than the operator token.

Verification order is fixed: header → MAC → payload. A refusal never says why a token was not accepted, so the door cannot be used as an oracle.

A formation member’s door also takes formation tokens. A door built with a FormationVerifier lets in a crate::formation_credentials token issued to it as the credential member:<caller>, with exactly FORMATION_CALL_SCOPES. A genuine token issued for another member’s door is 403 not_permitted; any other token of that family is the same 401 as any other invalid token. A door with no verifier refuses every formation token as invalid.

A scope limits methods; the credential limits tasks. The operator token reaches every task of the session, as every caller of a public door does. Any other token reaches only the tasks a request carrying its credential started, through every method that names or lists a task: GetTask, ListTasks, CancelTask, SubscribeToTask, a message’s taskId and its referenceTaskIds. A task it does not reach is answered as one the session never held. murmur.WatchSession and murmur.StopSession are the session’s own methods, and reach every task whatever the credential holding them started. [crate::identity::TaskCaller] states the rule.

A token reaches no guest, no trace, no log, no error body and no Debug output. DoorToken implements neither Display nor Serialize, and DoorToken::expose is the one way to read it.

Structs

DoorAuth

One session’s door key and the tokens minted with it, and — for a formation member — what its door checks a formation token with.

DoorGrant

What a verified token reaches.

DoorToken

One door token’s text.

PublicDoorDisclosure

What a public door hands any caller, read from the manifest alone so that every surface renders the same line for the same manifest.

Enums

AuthRefusal

Why the door refused a request before looking at what it asked for.

DoorExposure

How the door is reachable off this host.

Constants

DOOR_TOKEN_DOMAIN

The MAC domain of a door token. Distinct from every other family’s, so no other token this process mints can verify at the door.

DOOR_TOKEN_ENV

The environment variable mur cancel and mur watch read a door token from when the capsule is named by --url rather than by session address.

DOOR_TOKEN_TAG

The version tag of a door token.

RESOURCES_FILES_SCOPE

The scope that reaches the operator resource plane under /resources/files.

Functions

bearer_header

The Authorization header value that presents token.

door_posture

The one-line posture mur doctor prints for the door: public (no network.authentication), or bearer — operator, <name> (<scopes>), ….

is_loopback_bind

Whether a --bind address keeps the door on this host: an IPv4 address in 127.0.0.0/8, ::1, or localhost. Every other address, 0.0.0.0 and :: among them, and every other hostname, exposes it.

public_door_bind_warning

The W-SEC-032 line for mur run --bind <bind_addr> and mur doctor --bind <bind_addr>, or None for a loopback bind.

public_door_warning

The W-SEC-032 line for manifest exposed as exposure, or None when the manifest declares network.authentication or serves no door at all (no inference: block).

render_public_door_warning

The one W-SEC-032 line.