Module auth 

JWT authentication and route-level authorization.

Validates Authorization: Bearer JWTs, enforces per-route policies (require_auth / required_roles), and forwards selected claims to the upstream as request headers. Active only when auth.mode == "jwt".

Verification itself sits behind TokenVerifier: by default the built-in one (keys from auth.jwt — an Ed25519 PEM file or a JWKS endpoint, checked with jsonwebtoken), or an embedder-supplied one injected through ProxyServer::with_token_verifier. Everything else here — policies, roles, claim headers — is independent of which one verified the token.

Modules

authz

External authorization via the Envoy ext_authz gRPC contract.

crypto

Process-wide jsonwebtoken crypto provider selection.

forward

Forward-auth verification endpoint.

jwks

JWKS fetching and key cache.

policy

Route-level access policies.

Structs

Auth

Compiled auth configuration: the verifier, the claims to forward, and the route policies.

Functions

middleware

Axum middleware enforcing JWT auth and route policies.