Struct AccessTokenSubstrateResourceService 

pub struct AccessTokenSubstrateResourceService<'a> { /* private fields */ }

Cross-mode resource service for verifying bearer tokens and forwarding propagation requests.

Capabilities

Method	Description
authenticate_authorization_header	Verify a bearer token from an Authorization header
parse_propagation_directive	Extract and parse the propagation directive from request headers
propagate_request	End-to-end: extract bearer + directive from request, verify, and forward
propagate_bearer	Low-level: forward a pre-extracted bearer to a downstream target

Service pattern

Constructed from ServerState via resource_service() when both substrate_runtime and oauth_resource_server_verifier are present, mirroring BackendOidcModeAuthService.

Implementations

impl<'a> AccessTokenSubstrateResourceService<'a>

pub fn new( runtime: &'a AccessTokenSubstrateRuntime, verifier: &'a OAuthResourceServerVerifier, ) -> Self

pub async fn authenticate_authorization_header( &self, authorization_header: Option<&str>, ) -> Result<Option<ResourceTokenPrincipal>, AccessTokenSubstrateResourceServiceError>

Verify a bearer token extracted from an Authorization header.

Returns None when the header is absent or not a bearer token.

pub fn parse_propagation_directive( headers: &HeaderMap, ) -> Result<Option<PropagationDirective>, AccessTokenSubstrateResourceServiceError>

Extract and parse a PropagationDirective from request headers.

Returns Ok(None) when the x-securitydept-propagation header is absent, Ok(Some(directive)) when present and valid, or PropagationDirectiveInvalid when the header value is malformed.

pub async fn propagate_request<F: PropagationForwarder>( &self, forwarder: &F, request: Request<F::Body>, ) -> Result<Response<F::Body>, AccessTokenSubstrateResourceServiceError>

End-to-end propagation: extract, verify, and forward.

1. Extracts the bearer token from the Authorization header and verifies it via the configured OAuthResourceServerVerifier.
2. Parses the PropagationDirective from the x-securitydept-propagation header.
3. Delegates to propagate_bearer.

This is the recommended entry-point for propagation route handlers.

pub async fn propagate_request_with_diagnosis<F: PropagationForwarder>( &self, forwarder: &F, request: Request<F::Body>, ) -> DiagnosedResult<Response<F::Body>, AccessTokenSubstrateResourceServiceError>

End-to-end propagation with a machine-readable diagnosis surface.

pub async fn propagate_bearer<F: PropagationForwarder>( &self, forwarder: &F, bearer: &PropagatedBearer<'_>, target: &PropagationRequestTarget, request: Request<F::Body>, ) -> Result<Response<F::Body>, AccessTokenSubstrateResourceServiceError>

Validate and forward a bearer token to a downstream propagation target.

This is the low-level building block used by propagate_request. Use it directly when the bearer and target have already been extracted and verified by the caller.

Trait Implementations

impl<'a> Clone for AccessTokenSubstrateResourceService<'a>

fn clone(&self) -> AccessTokenSubstrateResourceService<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Copy for AccessTokenSubstrateResourceService<'a>