Enum AuthEngine 

pub enum AuthEngine {
    Open,
    Basic,
    ApiKey {
        keys: Vec<String>,
        header: HeaderName,
    },
    Jwt(Box<JwtValidator>),
}

Per-request authentication engine, built once from AuthCfg and held in the hot-swappable runtime.

Variants

Open

No authentication — every request is allowed with no principal.

Basic

ApiKey

Fields

keys: Vec<String>

header: HeaderName

Jwt(Box<JwtValidator>)

Implementations

impl AuthEngine

pub fn build(cfg: &AuthCfg) -> Result<AuthEngine>

Build the engine for the configured mode. Fails fast on a malformed JWT policy (bad algorithm, unparseable static key) so a misconfiguration surfaces at startup/reload rather than as a blanket 401 at request time.

pub async fn authorize(&self, cfg: &AuthCfg, headers: &HeaderMap) -> Decision

Apply the gate to a request’s headers. Async because the JWT path may fetch a JWKS.