Skip to main content

check_auth

trustee_api::auth

Function check_auth 

Source 
pub async fn check_auth(
    auth: &Option<Arc<AuthState>>,
    headers: &HeaderMap,
) -> Result<(Option<String>, String), StatusCode>
Expand description

Check authentication for a protected endpoint.

Returns Ok((None, user_key)) if auth is not configured (open mode), or if a valid token is present without needing cookie renewal. Returns Ok((Some(cookie), user_key)) if auth succeeded and the caller should include the given Set-Cookie header value in the response (rolling session). Returns Err(StatusCode) if auth is configured but no valid token is found.

The returned user_key is the identity string used for session isolation (JWT sub claim for real users, dev:{email} for dev mode, "default" when auth is not configured). This avoids the need for handlers to call resolve_user_key() which would re-validate the JWT a second time.

Token sources (in order):

  1. Authorization: Bearer <token> header (raw JWT — validated directly)
  2. trustee_token=<session_id> cookie (looked up in WebSessionManager, auto-refreshed if near expiry)

Dev mode tokens use the format dev:email:name:username.