Enum AuthRequirement 

#[non_exhaustive]
pub enum AuthRequirement {
    Required,
    Optional,
    None,
}

Declares whether a command requires an authenticated credential.

This is the policy that the engine enforces; it is separate from the mechanism of resolution (see CredentialResolver). The default is Required, which fails closed: the engine resolves the credential before the handler runs, so a command that should be gated behind authentication cannot execute unauthenticated even if its handler never reads the credential, and audit/activity identity is always populated for it.

--schema and --dry-run short-circuit before the engine resolves a Required credential, so they never trigger an authentication flow on their own regardless of requirement.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Required

The engine resolves the credential before the handler runs (fail-closed).

A failure to resolve is rendered as an auth-error and the handler never runs. This is the default.

Optional

Resolution is deferred to the handler.

The engine does not resolve a credential on the command’s behalf; the handler (or an authorizer) triggers the auth flow only by calling CredentialResolver::resolve/try_resolve. Use for commands that behave differently when authenticated but must still run when the user is logged out.

None

The command never authenticates and has no credential.

Equivalent to the legacy no_auth(true) marker: default-env injection is suppressed and CredentialResolver::resolve returns an error.

Implementations

impl AuthRequirement

pub fn is_none(self) -> bool

Returns true when the command never authenticates.

pub fn is_required(self) -> bool

Returns true when the engine must resolve the credential before the handler runs.

pub fn is_optional(self) -> bool

Returns true when resolution is deferred to the handler.

Trait Implementations

impl Clone for AuthRequirement

fn clone(&self) -> AuthRequirement

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for AuthRequirement

impl Debug for AuthRequirement

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthRequirement

fn default() -> AuthRequirement

Returns the “default value” for a type.

impl Eq for AuthRequirement

impl PartialEq for AuthRequirement

fn eq(&self, other: &AuthRequirement) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AuthRequirement