Module auth 

The node-authorization handshake that gates a session (phase D, #881).

Runs BEFORE crate::session::run_session, over the same bidirectional stream, and reveals nothing about the account (not even confirmation that this peer hosts it) until the remote is authorized. Each side presents a signed transport-node ↔ account-device binding and verifies the other’s under its OWN admission policy — authorization is mutual, so a peer handed a poisoned address never streams its inventory to an impostor.

Ordering is asymmetric to close the metadata gap without deadlocking (the transfer phase that follows stays concurrent):

• the acceptor reads the dialer’s binding and verifies it BEFORE sending its own — an unauthorized dialer learns nothing, not even the acceptor’s binding;
• the dialer sends its binding (to the node iroh already authenticated it dialed) then verifies the acceptor’s before proceeding to the data phase.

A failure closes with one UNIFORM error regardless of cause (wrong account / not on roster / bad signature / stale) so a peer cannot probe “does this server host account A / know device D”.

Structs

AuthConfig

The non-stream inputs to one auth handshake, bundled so run_auth_phase takes the stream pair, the authorizer, and this — rather than a long argument train.

Enums

AuthError

A node-authorization handshake that did not admit the connection.

AuthPolicy

How a peer decides whether to admit a connection. Local policy, never negotiated on the wire — an impostor cannot assert Open to exempt itself from the other side’s Closed. Per-ACCOUNT, not per-endpoint: one transport node may legitimately serve several accounts, so a public account being Open must not open a private one on the same endpoint.

AuthRole

Which end of the connection this peer is — determines the send/verify order above.

Constants

DEFAULT_PRE_AUTH_TIMEOUT

How long a peer may take to send its auth frame before the handshake aborts. Deliberately much shorter than the data-phase idle timeout: an unauthorized peer that connects and stalls must not occupy the single-session accept slot for long.

Traits

NodeAuth

The account-authorization capability the transport needs from the store: mint our own binding, and verify a peer’s. Both resolve against the store’s account + live fold; kept separate from crate::session::SyncStore so the auth phase is testable without the data-phase machinery.

Functions

run_auth_phase

Run the mutual auth handshake. On Ok(()) both sides have verified each other under their own policies and the caller may proceed to crate::session::run_session over the same stream; on Err the caller drops the connection without revealing any inventory.