Struct AuthLayer 

pub struct AuthLayer { /* private fields */ }

Available on crate feature axum only.

Which credentials are accepted, where they are read from, and how a refusal looks. Cheap to clone (one Arc).

It is a tower::Layer, so router.route_layer(auth) (or .layer(auth)) protects routes directly; it is also the state for the require_auth middleware function (axum::middleware::from_fn_with_state(auth, require_auth)), which behaves identically.

Fail-closed by construction. AuthLayer::builder refuses to build without at least one credential; the only way to get a layer that lets requests through unauthenticated is to call AuthLayer::allow_unauthenticated by name (or to hand AuthLayer::from_decision or AuthLayerBuilder::build_with_decision a StaticTokenDecision::Unauthenticated, which crate::static_token_policy returns only when its allow_unauthenticated argument is true, and which can otherwise only be named directly).

Built once at startup. Nothing in it hot-reloads: a changed static token or OAuth config takes effect when a new layer is built, which in practice means a restart.

Implementations

impl AuthLayer

pub fn builder() -> AuthLayerBuilder

Start building an enforcing layer.

Give it a static token, an OAuth validator, or both; optionally the credential sources (default: Authorization: Bearer) and an on_reject callback. To honour accept_static_bearer, finish with build_with_decision and a crate::static_token_policy decision rather than setting the static token directly.

Examples

use axum::{Router, http::HeaderName, routing::get};
use oauth_resource_server::axum::{AuthLayer, AuthLayerError, CredentialSource};

// A static API key accepted from either header. (With OAuth, add
// `.oauth(validator)` as well.)
let auth = AuthLayer::builder()
    .static_token("example-static-key")
    .sources([
        CredentialSource::authorization_bearer(),
        CredentialSource::Raw(HeaderName::from_static("x-api-key")),
    ])
    .build()
    .unwrap();
let app: Router = Router::new()
    .route("/api", get(|| async { "protected" }))
    .route_layer(auth);

// Fail closed: no credential configured is an error, not a pass-through.
assert_eq!(AuthLayer::builder().build().unwrap_err(), AuthLayerError::NoCredential);

pub fn allow_unauthenticated() -> Self

A layer that lets EVERY request through, unauthenticated, and inserts no credential into request extensions (so Option<Credential> and Option<AuthorizedToken> extract None, and the non-Option extractors refuse with a 401 carrying DEFAULT_STATIC_CHALLENGE; see the module docs).

The explicit opt-out. The only other pass-through is a crate::StaticTokenDecision::Unauthenticated handed to AuthLayer::from_decision or AuthLayerBuilder::build_with_decision, which builds this same layer. Pair it with a loud startup warning. crate::static_token_policy returns crate::StaticTokenDecision::Unauthenticated exactly when an application has chosen this.

Security

Every request reaches the protected routes. Use it only where something else (a trusted network, a proxy that authenticates) stands in front. It still marks every Authorization header value sensitive (http::HeaderValue::set_sensitive), so a credential a client sends anyway is not printed by a Debug of the request downstream.

pub fn from_decision( decision: StaticTokenDecision, oauth: Option<Arc<OAuthValidator>>, ) -> Result<Self, AuthLayerError>

The layer a crate::static_token_policy decision calls for, with the default source (Authorization: Bearer) and refusal shape — the whole startup mapping in one call. Shorthand for AuthLayer::builder().optional_oauth(oauth).build_with_decision(decision); use that form to set sources or on_reject as well.

Errors

See AuthLayerBuilder::build_with_decision.

pub fn allows_unauthenticated(&self) -> bool

Whether this is the AuthLayer::allow_unauthenticated pass-through.

pub fn oauth(&self) -> Option<&Arc<OAuthValidator>>

The OAuth validator, when one is configured.

Trait Implementations

impl Clone for AuthLayer

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthLayer

Hand-written so the static token never reaches a log line through {:?}.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S> Layer<S> for AuthLayer

type Service = AuthService<S>

The wrapped service

fn layer(&self, inner: S) -> Self::Service

Wrap the given service with the middleware, returning a new service that has been decorated with the middleware.