Expand description
Axum extractor that authenticates requests via a Schubert capability
token in the Authorization: Bearer <token> header.
Requires both http and server-auth. The IjimaAuth is shared
via axum’s built-in Extension layer
(router.layer(Extension(Arc::new(ijima_auth)))). The handler
obtains an AuthenticatedPrincipal as a parameter; deeper
capability checks go through crate::IjimaAuth::require on the
same shared state.
Structs§
- Auth
Principal - Extractor: validates the bearer token and yields the authenticated principal + capability.
Enums§
- Auth
Rejection - Error returned when authentication fails; maps to HTTP 401. When
Schubert rate limiting is enabled and the principal’s token bucket is
exhausted, [
AuthRejection::RateLimited] maps to HTTP 429.
Type Aliases§
- Auth
Error - Back-compat alias: the historical single-variant name.