Struct AuthContext 

pub struct AuthContext {
    pub user_id: String,
    pub session_id: String,
    pub roles: Vec<String>,
    pub metadata: Value,
}

Per-connection authentication context, populated during WS upgrade.

This context is extracted from HTTP cookies (or other auth mechanisms) during the WebSocket handshake and attached to the connection. Every RPC call on that connection has access to this context.

Multi-tenancy with Keycloak

When using Keycloak for multi-tenancy, the AuthContext typically contains:

• user_id: Keycloak user ID (sub claim from JWT)
• session_id: Keycloak session ID
• roles: User roles within the tenant/realm
• metadata: Additional JWT claims (realm, tenant ID, custom attributes)

Fields

user_id: String

User identifier (e.g., Keycloak sub claim, user UUID)

session_id: String

Session identifier (e.g., Keycloak session ID)

roles: Vec<String>

User roles (e.g., [“user”, “admin”], Keycloak realm roles)

metadata: Value

Additional metadata (e.g., JWT claims, tenant/realm info, custom attributes) For Keycloak multi-tenancy, this typically includes:

• realm: Keycloak realm name
• tenant_id: Organization/tenant identifier
• Any custom claims from the JWT token

Implementations

impl AuthContext

pub fn new( user_id: String, session_id: String, roles: Vec<String>, metadata: Value, ) -> AuthContext

Create a new AuthContext.

Note

This constructor is pub to preserve the existing public API across the workspace. AUTHZ-0’s structural-defense vision calls for this constructor to be pub(crate); tightening that seal lands in a follow-up ticket because of the workspace-wide blast radius. See plans/AUTHZ/AUTHZ-CORE-CRATE-1-RUN-NOTES.md.

pub fn anonymous() -> AuthContext

Create an anonymous/unauthenticated context.

This can be used as a fallback when methods accept Option<&AuthContext> and no authentication was provided.

pub fn is_authenticated(&self) -> bool

Check if this context represents an authenticated user.

pub fn has_role(&self, role: &str) -> bool

Check if the user has a specific role.

pub fn get_metadata_string(&self, key: &str) -> Option<String>

Get a metadata field as a string.

pub fn tenant(&self) -> Option<String>

Get the tenant/realm from metadata (Keycloak multi-tenancy).

pub fn with_callee_context<F, R>( &self, derivation: &ForwardDerivation, immediate_caller_stamp: &Principal, f: F, ) -> R

where F: FnOnce(AuthContext) -> R,

Scoped-callback API for deriving a callee context.

The framework’s dispatch path (plexus-core route_to_child) calls this with a ForwardDerivation and a caller-principal stamp; the closure receives the derived callee AuthContext by value and returns whatever the dispatch yields (typically a Future). Passing by value rather than reference is intentional: it allows the closure to move the callee into an async block so dispatch can await the child call while the callee lives inside the future’s state machine.

This is the public entry point for AUTHLANG-3. The underlying constructor [derive_callee_context] remains pub(crate) so the raw “mint a callee from a caller” symbol is not callable from outside plexus-auth-core. Anyone can still call AuthContext::new and craft their own context from scratch — what they cannot do is obtain one through the framework-blessed derivation path except inside this callback, where the lifetime is scoped to the dispatch invocation.

Per AUTHZ-0 §“The sealed-type pattern”: the policy proposes (via ForwardDerivation); the framework disposes (via this callback).

Trait Implementations

impl Clone for AuthContext

fn clone(&self) -> AuthContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuthContext

fn deserialize<__D>( __deserializer: __D, ) -> Result<AuthContext, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for AuthContext

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for AuthContext

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.