Module auth_resolver 

Injection seam for closed-side authentication.

The OSS http-server keeps no JWT/cookie/API-key state — those moved to the closed cognee-http-cloud crate alongside the auth router family. To let closed embedders plug their auth chain back into the OSS AuthenticatedUser extractor, OSS stores an optional Arc<dyn AuthResolver> on AppState.

• AuthResolver::resolve is the full chain (Bearer → cookie → API key → optional ExtraAuthValidator hook). Returns Some(user) if any method succeeds, else None so the extractor can fall through to the default-user path (or 401 when require_authentication=true).
• ExtraAuthValidator is the narrower Auth0/OIDC-only hook the plan names explicitly. A closed embedder that only wants to add an Auth0 hook (and not replace the whole chain) installs only this — the OSS RouterBuilder::with_extra_validator(...) wraps it in a default resolver that calls just the validator.

Traits

AuthResolver

ExtraAuthValidator

Functions

resolver_from_validator

Wrap an ExtraAuthValidator into an AuthResolver that performs only the validator step.