Struct AuthRuntime 

pub struct AuthRuntime { /* private fields */ }

Implementations

impl AuthRuntime

pub fn enter_request(&self) -> AuthServiceResult<AuthRequestGuard>

Admits an entrypoint request and keeps its provider work in the drain set.

Errors

Returns Unavailable once shutdown starts, including for whitelist paths.

pub fn config(&self) -> &AuthConfig

pub fn provider_registry(&self) -> &ProviderRegistry

pub fn authentication_service(&self) -> &AuthenticationService

pub fn authorization_service(&self) -> &AuthorizationService

pub fn enabled(&self) -> bool

pub const fn detailed_authorization_requirement(&self) -> LayerRequirement

Returns whether this runtime requires a detailed authorization result.

Disabled authorization is an explicit compatibility boundary and is the only configuration state represented by Optional here. Authentication failures and authorization failures remain fail-closed layer failures.

pub async fn reload_acl_file(&self) -> AuthServiceResult<usize>

pub fn is_acl_white_remote_address( &self, access_key: Option<&str>, source_ip: Option<&str>, ) -> AuthServiceResult<bool>

pub fn acl_generation(&self) -> u64

pub fn invalidate_acl_cache(&self) -> u64

pub fn acl_generation_counter(&self) -> Arc<AtomicU64>

pub fn metrics(&self) -> AuthMetrics

pub fn metrics_snapshot(&self) -> AuthMetricsSnapshot

pub fn update_global_white_remote_addresses<I, S>( &self, addresses: I, ) -> AuthServiceResult<u64>

where I: IntoIterator<Item = S>, S: AsRef<str>,

pub async fn shutdown(&self) -> AuthServiceResult<()>

pub async fn shutdown_with_report( &self, ) -> AuthServiceResult<Option<ShutdownReport>>

pub async fn shutdown_until( &self, deadline: ShutdownDeadline, ) -> AuthServiceResult<Option<ShutdownReport>>

pub fn acl_file_watcher_snapshot(&self) -> Vec<ScheduledTaskSnapshot>

pub async fn check_remoting( &self, auth_context: &RemotingAuthContext, command: &RemotingCommand, ) -> AuthServiceResult<()>

pub async fn check_remoting_for_code( &self, auth_context: &RemotingAuthContext, command: &RemotingCommand, original_code: i32, ) -> AuthServiceResult<()>

Checks a remoting command using the immutable operation captured at ingress rather than the processor-mutable command code.

pub async fn check_remoting_with_source_ip( &self, auth_context: &RemotingAuthContext, command: &RemotingCommand, source_ip: Option<&str>, channel_id: Option<&str>, ) -> AuthServiceResult<()>

pub async fn evaluate_remoting_detailed( &self, auth_context: &RemotingAuthContext, command: &RemotingCommand, ) -> LayerEvaluation<DetailedDecision>

Evaluates authentication and detailed authorization for a remoting request.

The global ACL whitelist remains an allow decision. When authorization is disabled, the authorization service returns Abstain; callers must resolve that value through the explicitly selected layer requirement. Errors never become an abstention and deliberately carry no request or credential data.

pub async fn evaluate_remoting_detailed_for_code( &self, auth_context: &RemotingAuthContext, command: &RemotingCommand, original_code: i32, ) -> LayerEvaluation<DetailedDecision>

Evaluates remoting authentication and authorization against the immutable operation code captured by trusted ingress.

pub async fn authenticate_maintenance_principal( &self, command: &RemotingCommand, channel_id: Option<&str>, ) -> AuthServiceResult<CheetahString>

Authenticates a privileged maintenance request and returns the verified identity consumed by the independent maintenance policy.

Unlike the ordinary remoting path, this method never treats disabled authentication or an authentication whitelist as success.

Trait Implementations

impl Clone for AuthRuntime

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.