Struct IdentityPayload 

pub struct IdentityPayload {
    pub subject: Option<SubjectExtension>,
    pub client: Option<ClientExtension>,
    pub caller_workload: Option<WorkloadIdentity>,
    pub delegation: Option<DelegationExtension>,
    pub raw_credentials: Option<RawCredentialsExtension>,
    pub resolved_at: Option<DateTime<Utc>>,
    pub raw_claims: HashMap<String, Value>,
    /* private fields */
}

State threaded through the IdentityResolve hook chain.

See the module-level docs for the input/output split. In short: input fields are private (set once via the constructor + builders, never mutated), output fields are pub (handlers populate them on clones and return the updated payload).

Implements PluginPayload so it can flow through the executor’s existing Sequential-phase machinery — no bespoke plumbing.

Fields

subject: Option<SubjectExtension>

Resolved user identity. None until a handler populates it.

client: Option<ClientExtension>

Resolved OAuth client / gateway-access identity.

caller_workload: Option<WorkloadIdentity>

Resolved attested workload identity for the inbound peer.

delegation: Option<DelegationExtension>

Initial delegation chain parsed from act / equivalent claims.

raw_credentials: Option<RawCredentialsExtension>

Raw inbound tokens to stash in Extensions.raw_credentials.inbound_tokens after the chain completes (gated by read_inbound_credentials for consumers).

resolved_at: Option<DateTime<Utc>>

Optional resolution timestamp. Audit-useful.

raw_claims: HashMap<String, Value>

Raw decoded token claims, when a handler wants to expose them for audit/policy without elevating each claim to a typed field. Mirrors the Python raw_claims: dict[str, Any].

Implementations

impl IdentityPayload

pub fn new(raw_token: impl Into<String>, source: TokenSource) -> Self

Construct a payload with the required input fields populated. The most common entry point — hosts call this once per request before invoking the hook. Optional input slots (source_header, headers, client_host, client_port) are set via the .with_* builders below; output fields start as None / false / empty and accumulate as handlers run.

pub fn with_source_header(self, h: impl Into<String>) -> Self

pub fn with_headers(self, h: HashMap<String, String>) -> Self

pub fn with_client_host(self, h: impl Into<String>) -> Self

pub fn with_client_port(self, port: u16) -> Self

pub fn raw_token(&self) -> &str

The raw credential bytes. Borrowed — handlers cannot move or replace the underlying Zeroizing<String> through this accessor.

pub fn source(&self) -> &TokenSource

pub fn source_header(&self) -> Option<&str>

pub fn headers(&self) -> &HashMap<String, String>

pub fn client_host(&self) -> Option<&str>

pub fn client_port(&self) -> Option<u16>

pub fn merge(&mut self, other: IdentityPayload)

Layer another payload’s output fields onto this one’s, following “Some replaces None, last write wins per slot.” Input fields are not touched — the running payload’s input is canonical for the whole chain.

Rejection is not a merged field — handlers reject via PluginResult::deny, which halts the chain at the framework level rather than being expressed as payload state. See the module docs for the rationale.

pub fn from_pipeline_result(result: &PipelineResult) -> Option<Self>

Pull the resolved IdentityPayload out of a PipelineResult returned by mgr.invoke_named::<IdentityHook>(...). Returns None when the pipeline was denied (no modified_payload) or when the result’s payload wasn’t an IdentityPayload — a programmer error if the latter, since the executor produces modified_payload typed per the hook’s HookTypeDef::Payload.

Clones the inner payload — the original Box<dyn PluginPayload> stays in the PipelineResult so callers can also inspect continue_processing, violation, etc.

pub fn apply_to_extensions(&self, ext: Extensions) -> Extensions

Apply this payload’s resolved identity slots back into an Extensions container. Returns a new Extensions ready to hand to the next hook in the request lifecycle (cmf.tool_pre_invoke, etc.) — downstream plugins read security.subject / security.client / security.caller_workload / raw_credentials etc. through the standard capability-gated filter.

Merging rules:

• security.subject / .client / .caller_workload — Some values on the payload overwrite the existing slot; other security fields (labels, classification, this_workload, auth_method, objects, data) are preserved from the input Extensions.
• raw_credentials — replaced wholesale when populated on the payload. Wholesale rather than merged because handlers produce the complete set of inbound tokens for this request; the host’s pre-invoke Extensions wouldn’t normally carry one.
• delegation — replaced wholesale when populated. Initial chain from act claims in the inbound credential.

Input fields on the payload (raw_token, headers, …) are not copied into Extensions — they’re the resolver’s internal workspace, not request-wide state.

Trait Implementations

impl Clone for IdentityPayload

fn clone(&self) -> IdentityPayload

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IdentityPayload

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for IdentityPayload

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PluginPayload for IdentityPayload

fn clone_boxed(&self) -> Box<dyn PluginPayload>

Clone this payload into a new Box<dyn PluginPayload>.

fn as_any(&self) -> &dyn Any

Downcast to a concrete type via &dyn Any.

fn as_any_mut(&mut self) -> &mut dyn Any

Downcast to a concrete type via &mut dyn Any.

impl Serialize for IdentityPayload

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.