Module auth 

Who is calling, and what they may read.

Authorisation here is per application, not per server: a token that reads billing reads billing and nothing else. That is the decision the threat model turns on — a config server holds every service’s configuration, so a credential scoped to the server is every secret at once, and the blast radius of a leaked pod token has to be the pod’s own section.

There is exactly one credential shape: a bearer token, presented in Authorization. A client certificate is not a second one — with [server.tls] and a client_ca it is a gate the connection passes before a request exists, and nothing in this module knows or cares that it happened. JWT validation is deliberately absent rather than half-present; see the crate documentation, and crate::tls for why a certificate names no principal here.

Structs

Authenticator

Turns an Authorization header into a Principal, or into nothing.

Principal

An authenticated caller and the applications it may read.

Token

A bearer token, as configured.

Constants

MIN_TOKEN_LEN

The shortest token this server will accept in its configuration.