Struct Gate 

pub struct Gate { /* private fields */ }

Implementations

impl Gate

pub fn new( store: Arc<AuthStore>, tailnet: Option<Tailnet>, access: Option<(Arc<AccessValidator>, AccessAllowList, Vec<String>)>, ) -> Gate

pub fn with_agents( self, tailnet_listens: Vec<String>, access: Option<(Arc<AccessValidator>, Vec<String>)>, ) -> Gate

Let orgs’ tailnet and Access agent identities in (crate::auth::agent_identities): the tailnet --listen addresses, and Access’s validator with the Host names to allow.

pub fn agent_ways(&self) -> AgentWays

Which agent identities can reach this server at all.

pub fn agent(&self, req: &Request, id: Option<&Identity>) -> Option<Principal>

The agent identity behind req, if an org maps it: a verified Access identity (id, else the request’s own assertion) on a loopback listener Access guards, or a tailnet peer, as tailscaled says. A bearer token decides on its own, so it is not asked here. Superadmin sources are judged first, by Gate::resolve.

pub fn edge(&self, req: &Request, id: Option<&Identity>) -> Option<EdgeIdentity>

The person a front door verified (crate::auth::edge): a verified Access user on a loopback listener Access guards, or an untagged tailnet peer. Service tokens and tagged nodes are not people. They may claim setup unless this front door’s superadmin allow list exists and leaves them out.

pub fn agent_fn(self: &Arc<Self>) -> AgentFn

Gate::agent and Gate::edge as the identity endpoints ask them.

pub fn edge_fn(self: &Arc<Self>) -> EdgeFn

pub fn tailnet(&self) -> Option<&Tailnet>

pub fn access_list(&self) -> Option<&AccessAllowList>

pub fn resolve(&self, req: &Request, id: Option<&Identity>) -> Resolved

id is the Access identity the listener already verified, if any. A bearer superadmin token decides alone; any other bearer token is not this gate’s. Then Access, then the tailnet.