pub async fn authenticate<S: State>(
state: &S,
headers: &HeaderMap,
) -> Result<AuthResult, Error>Expand description
Who a request is, from its Authorization header.
The one place a request is authenticated: REST calls this, and so does a
host’s own route that wants its caller to be who REST would say it is –
the server’s User extractor. Through the token cache where one is
configured, the anonymous role when no token is sent, and a failure
classified as PostgREST classifies it, for error_response to answer.
Keys fetched from a JWKS URL may need fetching first: the one await in
authenticating, and one that awaits nothing for a token whose key is
already held. See postrust_auth::jwks.
The auth span is at debug, beneath the request’s own span at info: with
the default filter it is never created, and a disabled span is a check of
a cached flag. Its fields are evaluated only when something is listening.
jwt.cache says whether the token cache answered: hit, miss, or
bypassed for a request with no token to look up. Absent where no cache
is configured. The cache counts the same outcomes for a metric; see
JwtCache::stats.