Struct Gate 

pub struct Gate { /* private fields */ }

Implementations

impl Gate

pub fn new( store: Arc<AuthStore>, tailnet: Option<Tailnet>, access: Option<(Arc<AccessValidator>, AccessAllowList, Vec<String>)>, ) -> Gate

pub fn with_agents( self, tailnet_listens: Vec<String>, access: Option<(Arc<AccessValidator>, Vec<String>)>, ) -> Gate

Let orgs’ tailnet and Access agent identities in (crate::auth::agent_identities): the tailnet --listen addresses, and Access’s validator with the Host names to allow.

pub fn agent_ways(&self) -> AgentWays

Which agent identities can reach this server at all.

pub fn agent(&self, req: &Request, id: Option<&Identity>) -> Option<Principal>

The agent identity behind req, if an org maps it: a verified Access identity (id, else the request’s own assertion) on a loopback listener Access guards, or a tailnet peer, as tailscaled says. A bearer token decides on its own, so it is not asked here. Superadmin sources are judged first, by Gate::resolve.

pub fn tailnet(&self) -> Option<&Tailnet>

pub fn access_list(&self) -> Option<&AccessAllowList>

pub fn resolve(&self, req: &Request, id: Option<&Identity>) -> Resolved

id is the Access identity the listener already verified, if any. A bearer superadmin token decides alone; any other bearer token is not this gate’s. Then Access, then the tailnet.