Struct ServiceAccountAuthenticator 

pub struct ServiceAccountAuthenticator { /* private fields */ }

Authenticates service-account secrets presented on the api-key header.

Implementations

impl ServiceAccountAuthenticator

pub fn from_config( accounts: &HashMap<String, ServiceAccountConfig>, resolve_secret: impl Fn(&str) -> Option<String>, ) -> Option<Arc<Self>>

Build an authenticator from the [service_accounts] config, resolving each account’s secret via resolve_secret (production: |env| std::env::var(env).ok()).

An account whose secret_env is unset/empty is skipped with a warning — it is simply unusable (fail-closed), never a silent anonymous grant. Returns None when no account resolves.

pub fn resolve(&self, headers: &HeaderMap, jwt_present: bool) -> SaAuth

Resolve a service-account principal from headers, honoring the JWT-collision rule (ADR-0018 amendment / rider 2). jwt_present is whether the request already carries a JWT-derived principal. The same logic backs every entry point (GraphQL, /ws, REST) so they cannot drift.

pub fn header_present(&self, headers: &HeaderMap) -> bool

Whether the request carries a (non-empty) service-account secret header. Used by callers to reject a request that also carries a JWT (ambiguous identity).

pub fn authenticate(&self, headers: &HeaderMap) -> Option<Box<SecurityContext>>

Authenticate a request. Returns the service account’s SecurityContext on an exact constant-time secret match, or None when the header is absent or present-but-unmatched (the caller cannot distinguish the two — no oracle).

Trait Implementations

impl Debug for ServiceAccountAuthenticator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.