Module auth 

Available on crate feature serve only.

Bearer-token authentication + RBAC authorization for /v1/* (#205). Constant-time comparison via subtle; the Authorization header is the only accepted credential. The bearer token resolves (via AuthMode::resolve) to an AuthContext, the request’s matched route declares the required Permission, and a role that lacks it is denied (403) with an audit record.

Functions

authorize_header

Validate a raw Authorization header value against the expected token.

require_auth

Axum middleware enforcing bearer auth + RBAC on /v1/*. Under --no-auth every request resolves to an implicit anonymous admin (all permitted), so the authz path is uniform. CORS preflight (OPTIONS) is allowed through so browsers (which omit Authorization on preflight) work behind a CORS policy.