Expand description
Bearer-token auth, the whole of it.
The posture is single-tenant: either a shared secret guards every endpoint, or the server trusts its caller and a reverse proxy owns auth. There is no user model and no RBAC.
When AppState::auth_token is set, this
middleware requires Authorization: Bearer <that token> on every request
and answers anything else with a 401 carrying the standard error
envelope. When it is unset, the middleware is a pass-through.
Functionsยง
- require_
bearer - Rejects a request whose bearer token is missing or wrong, when a token is configured; otherwise passes it straight through.