Struct ServerSecurity 

pub struct ServerSecurity { /* private fields */ }

Shared by the listener and router. A request pins one complete generation.

Implementations

impl ServerSecurity

pub fn new( policy: SecurityPolicy, tls: Option<TlsConfig>, ) -> Result<Arc<Self>, SecurityError>

Publishes the first generation and fixes the transport mode: TLS if tls is present, plaintext otherwise. replace cannot change that mode later.

Errors

Returns a SecurityError if policy maps client certificates but tls is absent or has no client CA.

pub fn replace( &self, policy: SecurityPolicy, tls: Option<TlsConfig>, ) -> Result<(), SecurityError>

Existing connections consult the new role map on their next request. Changing transport mode requires restarting the listener; TLS cannot be removed by a credential reload on an exposed listener.

pub fn encrypted(&self) -> bool

Whether this server was constructed with TLS. Fixed for its lifetime; serve refuses a non-loopback listener when it is false.