Struct AuthMiddleware 

pub struct AuthMiddleware { /* private fields */ }

The authentication middleware.

Checks all configured authentication methods in order: mTLS → JWT → API key. First success wins.

Implementations

impl AuthMiddleware

pub fn new(config: AuthConfig) -> Result<Self, AuthError>

Create a new authentication middleware from configuration.

Errors

Returns AuthError::Config if the JWT configuration contains an unrecognized algorithm string.

pub fn is_exempt(&self, path: &str) -> bool

Check if a path is exempt from authentication.

Uses segment-boundary matching instead of raw prefix matching to prevent bypass via path manipulation (e.g., /healthz, /health/../api/v1/write, /health%2F..).

**** Percent-decodes the path before normalization to prevent bypass via %2F (/) and %2E (.) encoded characters.

A path matches an exempt entry if it is either an exact match or the exempt path is a proper directory prefix (path starts with exempt + "/").

pub fn authenticate( &self, bearer_token: Option<&str>, client_cert_cn: Option<&str>, ) -> Result<AuthContext, AuthError>

Authenticate a request.

Parameters:

• bearer_token: The value from Authorization: Bearer <token> header
• client_cert_cn: The client certificate CN (from mTLS handshake)

Returns the authentication context on success.

pub async fn authenticate_async( &self, bearer_token: Option<&str>, client_cert_cn: Option<&str>, ) -> Result<AuthContext, AuthError>

Authenticate a request, consulting a JWKS endpoint when one is configured.

Identical to authenticate except that the JWT step can fetch and cache the issuer’s published keys. The two share every decision — which method wins, when a failure may fall through to a weaker one — so they cannot drift apart; only the JWT call differs, because fetching keys needs to await.

Errors

As authenticate.

pub fn jwt_validator(&self) -> Option<&JwtValidator>

The JWT validator, when one is configured.

pub fn set_jwks_cache(&mut self, cache: Arc<JwksCache>)

Attach a JWKS cache to the JWT validator.

Called at startup once the issuer’s keys have been fetched.

pub fn is_configured(&self) -> bool

Check whether any authentication method is configured.

Trait Implementations

impl Clone for AuthMiddleware

fn clone(&self) -> AuthMiddleware

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthMiddleware

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.