Module auth 

Authentication module for Trustee API.

Uses PEP for OIDC/OAuth2:

• ResourceServerClient for JWT validation (offline, cached JWKS)
• OidcClient for authorization code + PKCE login flow
• PkceCookieManager for stateless PKCE state (HMAC-signed cookies)
• DevConfig for local development bypass

Two deployment modes:

• Standalone: browser hits /auth/login → IdP redirect → /auth/callback → cookie
• Centralized: external auth app sends Authorization: Bearer <token> directly

Token extraction order: Authorization: Bearer header → trustee_token cookie.

Structs

AuthConfig

Authentication configuration parsed from [oidc] and [dev] TOML sections.

AuthState

Shared authentication state, stored in ServerState.

AuthUser

Authenticated user info extracted from the token.

CallbackQuery

Query parameters for OIDC callback.

McpCallbackQuery

Query parameters for MCP OIDC callback.

McpLoginQuery

Query parameters for MCP login initiation.

Enums

AuthError

Authentication errors.

Functions

auth_routes

Build the auth routes as a nested Router.

check_auth

Check authentication for a protected endpoint.