Struct ApiKeyStore 

pub struct ApiKeyStore { /* private fields */ }

Thread-safe token store, keyed by opaque bearer-token string.

Implementations

impl ApiKeyStore

pub fn new(config: AuthConfig) -> Self

Create a new token store.

pub fn disabled() -> Self

Create a store with authentication disabled.

pub fn add_key(&self, key: impl Into<String>)

Add a legacy full-control API key.

Backward-compatibility path (spec §4): a bare key with no declared capabilities maps to a full-control token holding the wildcard, so any existing --api-key / --require-auth consumer is unaffected and can never trigger a 403.

pub fn add_token(&self, key: impl Into<String>, record: TokenRecord)

Register a token string with an explicit capability record.

pub fn add_key_with_capabilities( &self, key: impl Into<String>, capabilities: CapabilitySet, label: impl Into<String>, )

Register a token with the given capabilities and label.

pub fn remove_key(&self, key: &str) -> bool

Remove a token.

pub fn is_valid(&self, key: &str) -> bool

Check if a token is registered (valid).

pub fn capabilities(&self, key: &str) -> Option<CapabilitySet>

Look up the capabilities a token grants, if it is registered.

This is the store surface the scope-aware middleware consumes (spec §5 step 2): token → TokenRecord → capability check.

pub fn identity(&self, key: &str) -> Option<Identity>

Identify a token for the audit trail, without revealing it.

pub fn count(&self) -> usize

Get the number of registered tokens.

pub fn is_enabled(&self) -> bool

Check if authentication is enabled.

pub fn extract_key(&self, header_value: &str) -> Option<String>

Extract API key from authorization header.

Trait Implementations

impl Debug for ApiKeyStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ApiKeyStore

fn default() -> Self

Returns the “default value” for a type.