Struct DidHostingServerAuthBackend 

pub struct DidHostingServerAuthBackend { /* private fields */ }

Implementations

impl DidHostingServerAuthBackend

pub fn from_state(state: &AppState) -> Result<Self, AppError>

Trait Implementations

impl AuthBackend for DidHostingServerAuthBackend

type Store = DidHostingSessionStore

Session storage adapter.

type Error = AppError

Backend-local error type. Must convert from AuthError so the canonical handler can raise auth-specific failures. Must implement IntoResponse at the route boundary; the trait does not bound that here (would force an axum dependency on every backend), but the canonical handler surfaces the error verbatim and the route layer renders it via its existing path.

type Role = Role

Backend’s role type. The handler holds it opaquely between ACL lookup and JWT minting.

fn sessions(&self) -> &Self::Store

Session store handle. The handler invokes the SessionStore methods through this.

fn mint_access_token<'life0, 'life1, 'life2, 'life3, 'life4, 'life5, 'life6, 'life7, 'async_trait>( &'life0 self, subject: &'life1 str, session_id: &'life2 str, role: &'life3 Self::Role, _contexts: &'life4 [String], amr: &'life5 [String], acr: &'life6 str, _tee_attested: bool, ttl_secs: u64, jti: &'life7 str, ) -> Pin<Box<dyn Future<Output = Result<String, Self::Error>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, 'life4: 'async_trait, 'life5: 'async_trait, 'life6: 'async_trait, 'life7: 'async_trait,

Mint an access token JWT for an authenticated session.

fn check_acl<'life0, 'life1, 'async_trait>( &'life0 self, did: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<RoleResolution<Self::Role>, Self::Error>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Resolve a DID to a role + context scope. Returning an error (typically AuthError::Forbidden) rejects the request before any other gate fires.

fn challenge_ttl(&self) -> u64

Challenge TTL in seconds. Typical: 60.

fn access_token_ttl(&self) -> u64

Access-token TTL in seconds. Typical: 900 (15 min).

fn refresh_token_ttl(&self) -> u64

Refresh-token TTL in seconds. Typical: 86400 (24 h).

fn validate_did<'life0, 'life1, 'async_trait>( &'life0 self, _did: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<(), Self::Error>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Self: 'async_trait,

Optional DID-method validation gate. Default: accept any method (backends with no allowlist). VTA overrides in TEE mode to enforce allowed_did_methods.

fn attest_challenge<'life0, 'life1, 'async_trait>( &'life0 self, _challenge_bytes: &'life1 [u8; 32], ) -> Pin<Box<dyn Future<Output = Result<AttestationOutcome, Self::Error>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Self: 'async_trait,

Optional TEE attestation hook. Returns the attestation report (if produced) and whether attestation succeeded. Default: no attestation (None, false). VTA overrides in TEE mode; in TeeMode::Required a failure here must be raised as AuthError::AttestationFailed.

fn max_pending_challenges_per_did(&self) -> usize

Cap on concurrent ChallengeSent sessions per DID. Default 10. Setting to 0 disables per-DID rate limiting (still IP-rate-limited at the tower-governor layer). Backends with low-trust callers may want this higher; backends with admin-only callers can keep it at 10.

fn audit(&self, event: AuthAuditEvent<'_>)

Audit hook fired at the end of each handler. Default impl emits via tracing::info!(audit=true); backends with structured audit pipelines (e.g. VTC’s audit log with HMAC actor hashing) can override.

fn access_token_ttl_for_aal2(&self) -> u64

Access-token TTL in seconds for a stepped-up (acr=aal2) session. Default: 1/3 of Self::access_token_ttl floored to a minimum of 60 seconds — closes M2 from the May 2026 security review, which observed that a leaked aal2 token has the same 15-minute window as a aal1 token despite the elevated privileges it grants.

fn didcomm_freshness_window(&self) -> u64

DIDComm created_time freshness window in seconds. The canonical handler rejects messages older than this against session.created_at to bound replay risk. Default 60s.