Struct AuthConfig 

pub struct AuthConfig {

    pub enabled: bool,
    pub jwks_url: Option<String>,
    pub expected_issuer: Option<String>,
    pub expected_audience: Option<String>,
    pub tenant_claim: String,
    pub allowed_algorithms: Vec<String>,
    pub jti_backend: String,
    pub redis_url: Option<String>,
    pub jwks_min_refresh_interval: u64,
    pub smart_token_endpoint: Option<String>,
    pub smart_authorize_endpoint: Option<String>,
    pub smart_jwks_url: Option<String>,
    pub smart_introspection_endpoint: Option<String>,
    pub smart_management_endpoint: Option<String>,
    pub smart_registration_endpoint: Option<String>,
    pub smart_revocation_endpoint: Option<String>,
    pub outbound_bearer_token: Option<String>,
}

Configuration for the authentication and authorization subsystem.

Fields

enabled: bool

Master switch — when false, all auth is bypassed.

jwks_url: Option<String>

JWKS endpoint URL. Required when enabled is true.

expected_issuer: Option<String>

Expected JWT issuer (iss claim). Validated if set.

expected_audience: Option<String>

Expected JWT audience (aud claim). Validated if set.

Recommended for production. Without audience validation, any valid token from the same issuer is accepted — even tokens intended for a different service. Set HFS_AUTH_AUDIENCE to restrict accepted tokens to those explicitly issued for this server.

tenant_claim: String

JWT claim name used to extract the tenant ID.

allowed_algorithms: Vec<String>

Comma-separated list of allowed JWT signing algorithms.

jti_backend: String

JTI cache backend: "memory" or "redis".

redis_url: Option<String>

Redis connection URL (required when jti_backend is "redis").

jwks_min_refresh_interval: u64

Minimum interval (seconds) between JWKS refreshes.

smart_token_endpoint: Option<String>

Token endpoint URL for /.well-known/smart-configuration.

smart_authorize_endpoint: Option<String>

Authorization endpoint URL.

smart_jwks_url: Option<String>

JWKS URL for the discovery document (may differ from jwks_url).

smart_introspection_endpoint: Option<String>

Introspection endpoint URL.

smart_management_endpoint: Option<String>

Management endpoint URL.

smart_registration_endpoint: Option<String>

Registration endpoint URL.

smart_revocation_endpoint: Option<String>

Revocation endpoint URL.

outbound_bearer_token: Option<String>

Static bearer token attached to outbound server-to-server requests (e.g., subscription notification dispatch). When set, an Authorization: Bearer <token> header is added to outbound calls. Subscription-supplied headers take precedence.

Implementations

impl AuthConfig

pub fn from_env() -> Self

Load configuration from environment variables.

pub fn outbound_provider(&self) -> Arc<dyn OutboundAuthProvider>

Build an outbound auth provider from this config.

Returns a StaticBearerOutboundAuthProvider when outbound_bearer_token is set, otherwise a NoOpOutboundAuthProvider.

Trait Implementations

impl Clone for AuthConfig

fn clone(&self) -> AuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthConfig

fn default() -> Self

Returns the “default value” for a type.