Struct AuthIdentity 

#[non_exhaustive]
pub struct AuthIdentity {
    pub name: String,
    pub role: String,
    pub method: AuthMethod,
    pub raw_token: Option<SecretString>,
    pub sub: Option<String>,
}

Identity of an authenticated caller.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

name: String

Human-readable identity name (e.g. API key label or cert CN).

role: String

RBAC role associated with this identity.

method: AuthMethod

Which authentication mechanism produced this identity.

raw_token: Option<SecretString>

Raw bearer token from the Authorization header, wrapped in SecretString so it is never accidentally logged or serialized. Present for OAuth JWT; None for mTLS and API-key auth. Tool handlers use this for downstream token passthrough via crate::rbac::current_token.

sub: Option<String>

JWT sub claim (stable user identifier, e.g. Keycloak UUID). Used for token store keying. None for non-JWT auth.

Trait Implementations

impl Clone for AuthIdentity

fn clone(&self) -> AuthIdentity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthIdentity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.