Expand description
Turns a wire-level credential into a verified IdentityId. Authorisation belongs to the policy engine, so a
deployment can swap authentication methods without touching policy enforcement.
Invariant: a successful authentication yields an IdentityId that resolves through the catalog to a real,
non-revoked identity. Minting one outside this crate bypasses revocation and is a security regression.
Modules§
- challenge
- error
- github
- method
- Authentication method implementations. Each owns its own credential format, verification logic and challenge
state, and registers with
registry/; adding a method means writing one module and registering it. - registry
- service
- The “authenticate this request” entry point server transports invoke. Per-method specifics live in submodules so the public surface stays method-agnostic.