Struct AuthConfig 

pub struct AuthConfig {
    pub basic: Option<BasicCredential>,
    pub authorizer: Authorizer,
    /* private fields */
}

Which credentials the server accepts. An empty config (the default) means the server is open — no interceptor is installed.

Fields

basic: Option<BasicCredential>

Accepted Basic username/password, if any.

authorizer: Authorizer

Per-query authorization policy, consulted after a query resolves. The default Authorizer::AllowAll is a no-op (no behavior change).

Implementations

impl AuthConfig

pub fn with_bearer_token(self, token: impl Into<String>) -> Self

A single accepted bearer token (back-compat shape). Equivalent to with_bearer_tokens with one element; the token names itself.

pub fn with_bearer_tokens<I, S>(self, tokens: I) -> Self

where I: IntoIterator<Item = S>, S: Into<String>,

A set of accepted bearer tokens for zero-downtime rotation. Any listed token authenticates; the first is issued by the handshake. Each token names itself as its Identity (use with_named_bearer_tokens to map tokens to authz identities).

pub fn with_named_bearer_tokens<I, S1, S2>(self, tokens: I) -> Self

where I: IntoIterator<Item = (S1, S2)>, S1: Into<String>, S2: Into<String>,

A set of accepted bearer tokens mapped to authz identity names, so several tokens can share one identity (e.g. an old and a new token for the same analyst role rotate transparently). Pairs are (token, identity_name); the first pair’s token is issued by the handshake.

pub fn add_bearer_token(&mut self, token: impl Into<String>) -> &mut Self

Add one accepted bearer token (self-named). Keeps any already added — the building block for rotation. Returns &mut Self for chaining.

pub fn add_named_bearer_token( &mut self, token: impl Into<String>, name: impl Into<String>, ) -> &mut Self

Add one accepted bearer token mapped to an authz identity name.

pub fn with_basic( self, username: impl Into<String>, password: impl Into<String>, ) -> Self

Accept Basic username / password.

pub fn with_authorizer(self, authorizer: Authorizer) -> Self

Attach a per-query Authorizer. Default is Authorizer::AllowAll.

pub fn authorize( &self, identity: &Identity, query_name: &str, ) -> Result<(), Status>

Authorize an already-resolved query for an identity (delegates to the configured Authorizer). Denial → permission_denied.

pub fn bearer_tokens(&self) -> impl Iterator<Item = &str>

All accepted bearer token values, in insertion order.

pub fn is_enabled(&self) -> bool

Any credential method configured? When false, the server requires no authentication and the interceptor is skipped entirely.

pub fn issued_token(&self) -> Option<&str>

The token issued to a client after a successful handshake — the first configured bearer token, which the client then replays on each call.

pub fn check_header(&self, header: Option<&str>) -> Result<(), Status>

Validate an authorization header value against every configured method. Open servers accept anything (including a missing header).

A thin wrapper over authenticate that discards the resolved Identity; kept for call sites that only gate access.

pub fn authenticate(&self, header: Option<&str>) -> Result<Identity, Status>

Validate an authorization header and return the resolved Identity.

Open servers (no method configured) authenticate anything as Identity::Anonymous. Otherwise a valid Bearer token resolves to its mapped Identity::Token and valid Basic creds to Identity::Basic; anything else is unauthenticated.

pub fn check_basic(&self, b64: &str) -> Option<String>

Validate a base64-encoded user:pass Basic payload, returning the username on success.

Trait Implementations

impl Clone for AuthConfig

fn clone(&self) -> AuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthConfig

fn default() -> AuthConfig

Returns the “default value” for a type.