toolkit_security/route_auth.rs
1//! Per-route credential requirement shared by `OperationSpec`, listeners and the gateway.
2
3/// Which credential a route requires. Exhaustive on purpose: a new policy must be
4/// handled explicitly by every listener and the gateway.
5///
6/// A request carries one plane: on every route, a bearer and an internal token presented
7/// together are refused before either is validated.
8#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
9pub enum RouteAuth {
10 /// No credential required (`.anonymous()`). A gear listener with a tenant plane still
11 /// validates a presented bearer; the gateway ignores it.
12 Anonymous,
13 /// A validated tenant bearer is required (`.authenticated()`); an internal token is
14 /// dropped unvalidated.
15 Authenticated,
16 /// A validated `X-ToolKit-Internal-Token` is required; a bearer is dropped unvalidated
17 /// (`.platform_authenticated()`).
18 Platform,
19}