Struct TrustedIdentityVerifier 

pub struct TrustedIdentityVerifier;

Tokenless trusted-upstream verifier — AUTH_MODE=trusted.

For the proxied-integration deployment shape: an existing application’s backend has already authenticated the user and proxies smooth-operator over a trusted/internal network. That upstream forwards the user’s identity (sub / org / role / groups); smooth-operator trusts it without any signature verification — the upstream owns identity and token lifetime, so there is no signature to check and no exp to enforce.

Wire format — identity in the same slot a token would ride

The forwarded identity rides in the exact same slot a JWT would: the /ws ?token= query param (reference server) or the send_message token field (Lambda). So all the existing transport plumbing is reused — the only difference from JwtVerifier is trust, don’t verify.

The value is base64url(JSON) of the [Claims] shape, e.g. base64url({"sub":"u1","org":"acme","role":"basic","groups":["github:acme/secret"]}). base64url is used (not raw JSON) so the blob survives the query-string and JSON-string transports cleanly without escaping. No padding is required (URL_SAFE_NO_PAD is accepted; padded URL_SAFE is also tolerated).

Security boundary — this is trust without verification

AUTH_MODE=trusted is only safe when smooth-operator is not directly reachable by clients — it must be fronted by your authenticated backend/proxy on a trusted network. A client that can reach /ws directly could forge any identity (any org, any groups). AuthConfig::from_env emits a loud startup tracing::warn! to that effect whenever this mode is selected.

Fail closed — never silently no-auth-admin

Absent / empty / malformed trusted identity yields an AuthError, which the connect path (crate::access_control::AccessContext::anonymous) maps to an anonymous connection (org-public only) — exactly like the no-token path. Trusted mode never degrades to an admin / all-access principal on bad input.

Implementations

impl TrustedIdentityVerifier

pub fn new() -> Self

Construct the trusted-identity verifier (stateless).

Trait Implementations

impl AuthVerifier for TrustedIdentityVerifier

fn verify(&self, forwarded_identity: &str) -> Result<Principal, AuthError>

Validate bearer_token (the raw token, without the Bearer prefix) and return the authenticated Principal.

fn mode(&self) -> &'static str

A short label for logs/metrics (never includes secrets).

impl Default for TrustedIdentityVerifier

fn default() -> Self

Returns the “default value” for a type.