Trait AuthProvider 

pub trait AuthProvider<S>: Send + Sync
where
    S: Clone + Send + Sync + 'static,
{
    // Required method
    fn verify_token<'life0, 'life1, 'async_trait>(
        &'life0 self,
        bearer: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<S, VerifyError>> + Send + 'async_trait>>
       where 'life0: 'async_trait,
             'life1: 'async_trait,
             Self: 'async_trait;
}

Perimeter token-validation port — the consumer-implemented seam.

One async method spans the consumer’s full security decision — cryptographic verification + substrate liveness lookup — and produces the consumer’s perimeter session type S directly. super::BearerAuthLayer calls this once per authenticated request and maps the two error variants to HTTP dispositions: VerifyError::Rejected → 401 + cookie clearance, VerifyError::SubstrateTransient → 503 with cookies preserved.

Why generic over S rather than returning a fixed claims type

chat-auth’s perimeter session has 5 fields (ppnum_id, ppnum, account_type, scopes, audience); RCW/CTW’s has 3. A fixed SDK-side AuthClaims would force chat-auth to run a second “hydration” Layer after the perimeter to enrich the session, breaking the single-perimeter invariant. The generic S lets each consumer’s substrate-aware impl produce its native session directly in one step.

Required Methods

fn verify_token<'life0, 'life1, 'async_trait>( &'life0 self, bearer: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<S, VerifyError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, Self: 'async_trait,

Validate the Bearer token end-to-end. The SDK Layer passes the raw token verbatim — no decoding, no trimming. The impl owns the substrate (JWKS cache, session-row lookup, sv-axis cache, or whichever combination this consumer composes).

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl<S> AuthProvider<S> for MemoryAuthProvider<S>

where S: Clone + Send + Sync + 'static,