Struct BearerValidator 

pub struct BearerValidator { /* private fields */ }

Stateless validator. Compare the Authorization: Bearer <token> header against the expected token; on match, return the daemon’s default tenant as the principal’s tenant_claim.

Dev-log 0152 M11: the token comparison is constant-time over the length of expected_token. Length differences ARE observable — but length-leak alone doesn’t recover the token (32-byte recommended minimum entropy). The byte-comparison accumulator pattern below avoids adding a subtle crate dependency for this single use.

Implementations

impl BearerValidator

pub fn new(expected_token: String, default_tenant: TenantId) -> Self

pub fn validate( &self, header: Option<&str>, ) -> Result<AuthenticatedPrincipal, AuthError>

Validate the value of an Authorization header. None is treated as a missing header (same as malformed).

Trait Implementations

impl Clone for BearerValidator

fn clone(&self) -> BearerValidator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for BearerValidator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.