Enum RoutePolicy 

pub enum RoutePolicy {
    Open,
    HumanForm,
    Signature,
    SignedLink,
    ApiKey,
}

How a request to a declared route proves it is legitimate.

The variants are mutually exclusive by construction: a route is protected by a human proof, a machine signature, an artifact this service issued, or nothing — never two of them, and never by whichever check the module happened to wire up.

Variants

Open

No gateway-level protection. The default, and correct for reads and for anything the handler authenticates itself.

HumanForm

A public form submission from a browser. The handler verifies the captchaToken the renderer supplies through the Captcha port, and Harness::build refuses to boot a production venture whose runtime cannot actually do that (captcha_effective).

Signature

An authenticated machine caller — a provider webhook. The handler proves the delivery with the module’s declared verifier (SignatureVerification: Payments::verify_webhook by default, or a webhook_signature scheme) plus the Inbox dedup ledger. A CAPTCHA is meaningless here (the caller has no browser) and must never be rendered or required on such a route.

SignedLink

A public write whose proof is a single-use, purpose-bound artifact this service issued: a magic link, a passkey or OAuth challenge, an unsubscribe link (issue #143). The caller presents something only a prior request of ours could have produced, so the gate is the Signer key ring (issue #137), not a widget.

This variant exists because the auth login methods had nowhere honest to sit. They are public writers with no ADR 0010 surface, so WriteGuards::collect’s conservative fallback filed them under CAPTCHA — and a passkey challenge will never render one. A production venture composing only auth modules therefore could not boot at all except through fz doctor --allow-no-captcha, an override the code itself documents as previews-only. This is not an exemption: it carries its own production requirement, a usable Signer, because without one there is nothing to issue or verify the artifact with.

ApiKey

An authenticated developer caller (issue #532): the request presents Authorization: Bearer <api key> and the handler gates it through require_api_key, which verifies the key’s hash and checks one scope. A CAPTCHA is meaningless here (the caller is a machine) and must never be rendered or required on such a route — the same rule as RoutePolicy::Signature.

This variant carries no scope on purpose: a RoutePolicy is Copy + serde and travels through surface documents, so it cannot hold a per-action string. The route policy says how the route is guarded; the scope is the handler’s per-request argument to require_api_key.

Implementations

impl RoutePolicy

pub fn is_guarded(self) -> bool

Whether this policy is a protection (as opposed to RoutePolicy::Open).

Trait Implementations

impl Clone for RoutePolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for RoutePolicy

impl Debug for RoutePolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RoutePolicy

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RoutePolicy

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for RoutePolicy

impl PartialEq for RoutePolicy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for RoutePolicy

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RoutePolicy