Module auth 

Authentication module for Trustee API.

Uses PEP for OIDC/OAuth2:

• ResourceServerClient for JWT validation (offline, cached JWKS)
• OidcClient for authorization code + PKCE login flow
• PkceCookieManager for stateless PKCE state (HMAC-signed cookies)
• DevConfig for local development bypass

Two deployment modes:

• Standalone: browser hits /auth/login → IdP redirect → /auth/callback → cookie
• Centralized: external auth app sends Authorization: Bearer <token> directly

Token extraction order: Authorization: Bearer header → trustee_token cookie.

Modules

actions

Cedar action names (P2, nghr 645809c3).

Structs

AuthConfig

Authentication configuration parsed from [oidc] and [dev] TOML sections.

AuthState

Shared authentication state, stored in ServerState.

AuthUser

Authenticated user info extracted from the token.

CallbackQuery

Query parameters for OIDC callback.

McpCallbackQuery

Query parameters for MCP OIDC callback.

McpLoginQuery

Query parameters for MCP login initiation.

Enums

AuthError

Authentication errors.

PrincipalKind

Principal kind (16D). Agent iff the enriched role claim contains “agent” — the exact value mapped by Kanidm’s pdt-api-agents group (role vocabulary: admin | user | service | agent, facts doc 42977cb7).

Functions

auth_routes

Build the auth routes as a nested Router.

check_auth

Check authentication for a protected endpoint.

check_dispatch_admin

16F: admin gate for the per-agent dispatch surface (/xagent/{name}).