Struct SecurityContext 

pub struct SecurityContext { /* private fields */ }

SecurityContext encapsulates the security-related information for a request or operation.

Built by the AuthN Resolver during authentication and passed through the request lifecycle. Gears use this context together with the AuthZ Resolver to obtain access scopes.

Implementations

impl SecurityContext

pub fn builder() -> SecurityContextBuilder

Create a new SecurityContext builder

pub fn anonymous() -> Self

Create an anonymous SecurityContext with no tenant, subject, or permissions.

Use this for unauthenticated / dev / auth-disabled contexts where no authenticated subject exists.

pub fn subject_id(&self) -> Uuid

Get the subject ID (user, service, or system) associated with the security context

pub fn subject_type(&self) -> Option<&str>

Get the subject type classification (e.g., “user”, “service”).

pub fn subject_tenant_id(&self) -> Uuid

Get the subject’s home tenant ID (from AuthN token).

pub fn token_scopes(&self) -> &[String]

Get the token scopes. ["*"] means first-party / unrestricted.

pub fn is_anonymous(&self) -> bool

Whether this context has no authenticated subject.

Anonymity is encoded as a nil subject_id / subject_tenant_id, the same fields a real subject uses, so there is nothing on the type that separates the two. Every consumer that cared was re-deriving this by hand — ctx.subject_id().is_nil() || ctx.subject_tenant_id().is_nil(), written out identically in the ledger and pricing gears — and a caller that forgets the check treats an unauthenticated request as a subject in the nil tenant.

pub fn has_scope(&self, scope: &str) -> bool

Whether the token carries scope.

The wildcard "*" satisfies every scope: it is what a first-party caller presents. An empty list satisfies none — it means no capability was granted, which is why this is the accessor to reason with rather than the raw list, where “empty” has repeatedly been read as its opposite.

pub fn bearer_token(&self) -> Option<&SecretString>

Get the original bearer token (for PDP forwarding).

Trait Implementations

impl Clone for SecurityContext

fn clone(&self) -> SecurityContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecurityContext

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityContext

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.