Struct AuthContext 

pub struct AuthContext {
    pub principal: String,
    pub method: AuthMethod,
    pub claims: HashMap<String, Value>,
    pub admin: bool,
    pub roles: Vec<String>,
    pub namespaces: Vec<String>,
}

Authentication context attached to each request.

Fields

principal: String

The principal name (e.g., key name, JWT subject, certificate CN).

method: AuthMethod

Which authentication method was used.

claims: HashMap<String, Value>

Additional claims from JWT (empty for API key / mTLS).

admin: bool

Whether this credential may perform administrative operations.

Carried on the credential rather than derived from a policy engine, because the policy engine is optional and “no policy” must not mean “everyone is an admin”.

roles: Vec<String>

Cedar roles this credential carries, as Chronix::Role memberships.

Resolved once, here, from whichever credential authenticated — a key’s roles list or the JWT claim named by auth.jwt.role_claim. They used to be re-derived inside the administrative gate alone, so the same role granted an admin operation and matched nothing in a namespace policy, and an API key had no roles at all: every policy in the documentation is written principal in Chronix::Role::"…".

namespaces: Vec<String>

Namespaces this credential may act in; empty means unrestricted.

Authentication answers who is calling; this answers whose data they may touch. Keeping the second on the credential is what stops a valid key from reading another tenant simply by changing a header.

Implementations

impl AuthContext

pub fn allows_namespace(&self, namespace: &str) -> bool

Whether this credential may act in namespace.

pub fn principal(&self) -> ChronixPrincipal

The Cedar principal for this credential.

The only producer. Every gate builds its principal from here, so none of them can be looking at a different identity or a different role set from the others.

Trait Implementations

impl Clone for AuthContext

fn clone(&self) -> AuthContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.