Module auth 

Request auth for operator routes (kernel spec §3.2, §3.3): the session cookie, behind the browser rules. It replaces the walking skeleton’s development bearer token.

Constants

SESSION_RECHECK

The longest a stream waits before it re-checks its session, however far off the expiry is. Tokio’s clock is monotonic and does not count time the machine is suspended, so a sleep until the expiry could wake long after it: a laptop asleep for a week would keep a stream past its session.

Functions

operator_only

Put router’s routes behind the browser rules (outermost) and the session cookie. Only routes added to router before this call are covered: add every operator route first.

require_operator

Axum middleware: the request must carry a live session cookie (401 unauthenticated otherwise). The session goes into the request’s extensions as Authenticated; when this request slid its expiry, the cookie is sent again so the browser’s copy lives as long. Not when the handler set a cookie of its own, nor once the session has ended (a request that revokes its own session): the browser keeps the last Set-Cookie, and that must not be the dead token.

require_step_up

Axum middleware, inside require_operator: the session’s last password or passkey check must be within the last five minutes (kernel spec §3.4), or the answer is 403 step_up_required and the client asks again.

session_ended

Resolves once session has ended: revoked, signed out, or expired. A stream a session holds open must not outlive it (3b decision 7), so long-lived responses end with this. It re-checks the session whenever the operator announces an ending, at its expiry (which may have slid since, through the session’s other requests), and at least every SESSION_RECHECK, against the wall clock.

step_up_required

403 step_up_required: what require_step_up answers, for a handler that needs a fresh step-up for only some of what it does.