pub async fn require_auth(
__arg0: State<ServerState>,
req: Request,
next: Next,
) -> Result<Response, ServeError>Available on crate feature
serve only.Expand description
Axum middleware enforcing bearer auth + RBAC on /v1/*. Under --no-auth
every request resolves to an implicit anonymous admin (all permitted), so
the authz path is uniform. CORS preflight (OPTIONS) is allowed through so
browsers (which omit Authorization on preflight) work behind a CORS policy.
On success the resolved AuthContext is
inserted into the request extensions for handlers (and the audit writer). A
principal whose role lacks the route’s required permission gets a 403 and a
denied audit record.