macp_auth/auth/
resolver.rs

1use crate::security::AuthIdentity;
2use std::collections::HashSet;
3use tonic::metadata::MetadataMap;
4
5#[derive(Debug)]
6pub enum AuthError {
7    InvalidCredential(String),
8    Expired,
9    MissingClaim(String),
10    FetchFailed(String),
11}
12
13impl std::fmt::Display for AuthError {
14    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
15        match self {
16            AuthError::InvalidCredential(msg) => write!(f, "invalid credential: {msg}"),
17            AuthError::Expired => write!(f, "credential expired"),
18            AuthError::MissingClaim(claim) => write!(f, "missing required claim: {claim}"),
19            AuthError::FetchFailed(msg) => write!(f, "key fetch failed: {msg}"),
20        }
21    }
22}
23
24impl std::error::Error for AuthError {}
25
26#[derive(Clone, Debug)]
27pub struct ResolvedIdentity {
28    pub sender: String,
29    pub allowed_modes: Option<HashSet<String>>,
30    pub can_start_sessions: bool,
31    pub max_open_sessions: Option<usize>,
32    pub can_manage_mode_registry: bool,
33    pub is_observer: bool,
34    pub resolver: String,
35}
36
37impl From<ResolvedIdentity> for AuthIdentity {
38    fn from(resolved: ResolvedIdentity) -> Self {
39        AuthIdentity {
40            sender: resolved.sender,
41            allowed_modes: resolved.allowed_modes,
42            can_start_sessions: resolved.can_start_sessions,
43            max_open_sessions: resolved.max_open_sessions,
44            can_manage_mode_registry: resolved.can_manage_mode_registry,
45            is_observer: resolved.is_observer,
46        }
47    }
48}
49
50/// Trait for pluggable auth resolvers.
51///
52/// Each resolver examines gRPC metadata and returns:
53/// - `Ok(Some(identity))` — positive verification, chain stops
54/// - `Ok(None)` — not my credential type, chain continues
55/// - `Err(e)` — credential is mine but invalid, chain stops with error
56#[async_trait::async_trait]
57pub trait AuthResolver: Send + Sync {
58    fn name(&self) -> &str;
59
60    async fn resolve(&self, metadata: &MetadataMap) -> Result<Option<ResolvedIdentity>, AuthError>;
61}
macp_auth/auth/resolver.rs

macp_auth/auth/
resolver.rs
