Struct AuthCtx 

pub struct AuthCtx {
    pub subject: String,
    pub issuer: String,
    pub audience: String,
    pub scopes: Vec<String>,
    pub kind: PrincipalKind,
    pub raw_token: String,
    pub expires_at: f64,
    pub extra: HashMap<String, Value>,
}

Identity + claims for the current request. The single concrete type that flows through the framework — outbound clients accept this, the server-side auth layer produces it. Custom claims live in Self::extra.

Fields

subject: String

sub claim. User ID for users, service ID for services.

issuer: String

audience: String

scopes: Vec<String>

kind: PrincipalKind

raw_token: String

The verbatim token. Used by AuthCtx::propagate for outbound calls.

expires_at: f64

Unix-seconds expiry. f64 to stay JSON-compatible with the Python and TS sides (which use number). 0.0 means “no expiry recorded” (e.g. an anonymous context). Use AuthCtx::expires_at_systime / AuthCtx::set_expires_at_systime when interop with std::time::SystemTime is convenient.

extra: HashMap<String, Value>

Claims not mapped to typed fields. Verifiers populate this with anything custom (e.g. tenant_id, role, agent_on_behalf_of).

Implementations

impl AuthCtx

pub fn anonymous() -> AuthCtx

Returns an empty AuthCtx for opt-out / no-auth flows.

pub fn from_bearer(token: impl Into<String>) -> AuthCtx

Wrap a bearer token without verification. For client-side code that already has a token (e.g., from a login flow) and wants to hand it to the framework’s outbound propagation.

pub fn from<T>(req: &Request<T>) -> AuthCtx

Pull AuthCtx from a tonic request’s extensions, populated by the inbound auth layer. Returns Self::anonymous if no layer ran.

pub fn propagate<T>(&self, req: &mut Request<T>)

Copy the bearer token onto an outbound request so the caller’s identity rides along to the next service.

pub fn require_scope(&self, scope: &str) -> Result<(), Status>

Authorize a single scope. Returns PermissionDenied if missing. Convenient for Status returns from handlers.

pub fn is_anonymous(&self) -> bool

pub fn expires_at_systime(&self) -> SystemTime

Convert expires_at (unix seconds) into a SystemTime. Returns UNIX_EPOCH for an anonymous / unset context (expires_at == 0.0).

pub fn set_expires_at_systime(&mut self, t: SystemTime)

Set expires_at from a SystemTime. Convenience for verifiers that already hold a SystemTime (e.g. JWT iat + max_age).

Trait Implementations

impl Clone for AuthCtx

fn clone(&self) -> AuthCtx

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthCtx

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuthCtx

fn deserialize<__D>( __deserializer: __D, ) -> Result<AuthCtx, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuthCtx

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.