Enum AuthValidator 

pub enum AuthValidator {
    Bearer(BearerValidator),
    Oidc(OidcValidator),
}

Resolves either to a BearerValidator or an OidcValidator depending on the [auth] block in the config. Built once at server start; cloned cheaply on every request.

Variants

Bearer(BearerValidator)

Oidc(OidcValidator)

Implementations

impl AuthValidator

pub fn from_config(config: &AuthConfig, default_tenant: TenantId) -> Self

Build from a config block + the daemon’s default tenant.

Bearer mode binds every authenticated request to the daemon’s default tenant; OIDC mode resolves the tenant per-token from the configured custom claim.

Operator foot-gun guard: bearer mode with an empty token would silently accept Authorization: Bearer (no actual secret). The daemon refuses this at boot by panicking — better to fail loudly than to ship a misconfigured [auth] block to production. The CLI --bearer-token-file path already refuses empty files in http_serve.rs::read_bearer_token_file; this closes the equivalent hole on the config-driven path.

Trait Implementations

impl Clone for AuthValidator

fn clone(&self) -> AuthValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.