Struct Authenticator 

pub struct Authenticator { /* private fields */ }

The single definition of the credential rules, shared by every surface.

Absent header → Principal::Anyone. Exactly one Authorization header carrying the service token, the WebDAV Basic pair (where accepted), or a bearer token the TokenVerifier vouches for → Principal::SignedIn. Anything else — a second header, an unknown scheme, a token nobody recognises — is CredentialRefused, never a downgrade to anonymous.

Implementations

impl Authenticator

pub fn new(service_token: impl Into<String>) -> Self

An authenticator that recognises only service_token as a bearer.

pub fn with_basic( self, username: impl Into<String>, password: impl Into<String>, ) -> Self

Also accept this Basic username and password, on surfaces that allow it.

pub fn with_token_verifier(self, verifier: Arc<dyn TokenVerifier>) -> Self

Also accept bearer tokens verifier vouches for.

pub fn with_protected_resource(self, resource: ProtectedResource) -> Self

Publish RFC 9728 metadata and name it in bearer challenges.

pub fn accepts_identity_tokens(&self) -> bool

Whether bearer tokens other than the service token can verify at all.

pub fn protected_resource(&self) -> Option<&ProtectedResource>

The published protected-resource metadata, if configured.

pub fn bearer_challenge(&self) -> Option<HeaderValue>

The WWW-Authenticate value a bearer-only surface adds to a 401.

Only present when metadata is published: a bare Bearer challenge tells a client nothing it did not know, and browsers ignore it, so there is nothing to gain from emitting one.

pub async fn resolve( &self, headers: &HeaderMap, accept: Schemes, ) -> Result<Principal, CredentialRefused>

Resolve the principal behind a request’s Authorization headers.

Errors

CredentialRefused when an Authorization header is present and does not carry exactly one credential this authenticator accepts.

Trait Implementations

impl Debug for Authenticator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.