Struct AuthContext 

pub struct AuthContext {
    pub key_path: Option<PathBuf>,
    pub use_agent: bool,
    pub use_password: bool,
    pub allow_password_fallback: bool,
    pub username: String,
    pub host: String,
}

Context for determining SSH authentication method.

This structure encapsulates all parameters needed to determine the appropriate authentication method for an SSH connection.

Security

• Usernames and hostnames are validated to prevent injection attacks
• File paths are canonicalized to prevent path traversal
• All sensitive data uses Zeroizing for secure cleanup

Fields

key_path: Option<PathBuf>

Optional path to SSH key file (validated and canonicalized)

use_agent: bool

Whether to use SSH agent for authentication

use_password: bool

Whether to use password authentication

allow_password_fallback: bool

Whether to allow automatic password fallback (for interactive mode)

username: String

Username for authentication prompts (validated)

host: String

Host for authentication prompts (validated)

Implementations

impl AuthContext

pub fn new(username: String, host: String) -> Result<Self>

Create a new authentication context with validation.

Errors

Returns an error if username or hostname are invalid

pub fn with_key_path(self, key_path: Option<PathBuf>) -> Result<Self>

Set the SSH key file path with validation.

Security

• Paths are canonicalized to prevent path traversal attacks
• Symlinks are resolved to their actual targets

pub fn with_agent(self, use_agent: bool) -> Self

Enable SSH agent authentication.

pub fn with_password(self, use_password: bool) -> Self

Enable password authentication.

pub fn with_password_fallback(self, allow: bool) -> Self

Enable automatic password fallback (for interactive mode).

When enabled, password authentication will be attempted automatically after SSH key authentication fails, matching OpenSSH behavior.

pub async fn determine_method(&self) -> Result<AuthMethod>

Determine the appropriate authentication method based on the context.

This method implements the standard authentication priority with security hardening:

1. Password authentication (if explicitly requested via –password flag)
2. SSH agent (if explicitly requested and available)
3. Specified key file (if provided and valid)
4. SSH agent auto-detection (if use_agent is true)
5. Default key locations (~/.ssh/id_ed25519, ~/.ssh/id_rsa, etc.)
6. Password authentication fallback (interactive terminal only, matches OpenSSH behavior)

The password fallback (step 6) matches standard OpenSSH behavior where password authentication is attempted as a last resort when all key-based methods fail. This only occurs in interactive terminals (when stdin is a TTY).

Security

• All file operations use canonical paths
• Authentication timing is normalized to prevent timing attacks
• Credentials are securely zeroized after use
• Password prompts only appear in interactive terminals

Errors

Returns an error if:

• No authentication method is available (non-interactive environment)
• SSH key file cannot be read or is invalid
• Password/passphrase prompt fails or times out
• SSH agent is requested but not available (Windows)

Trait Implementations

impl Clone for AuthContext

fn clone(&self) -> AuthContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.