Struct StepUpAuth

Source

pub struct StepUpAuth(pub AuthClaims);

Expand description

Extractor that requires a stepped-up session (JWT acr == "aal2").

Use on routes that demand a second factor beyond the base DID challenge-response (aal1) — typical examples: ACL edits, key rotation, backup export, anything that lets an attacker with a leaked aal1 token pivot to a long-lived foothold.

async fn rotate_keys(auth: StepUpAuth, ...) { /* aal2 enforced */ }

A request with a lower acr is rejected with AppError::StepUpRequired (403 + body { "error": "step_up_required", "requiredAcr": "aal2" }). The wallet uses that signal to trigger a passkey-login or VTA-approval ceremony — distinct from a generic forbidden it would get from a role gate.

Trust model: the gate reads acr from the JWT claims the AuthClaims extractor already verified (signature, expiry, session existence). Step-up tokens are stateless during their access-window; the canonical refresh handler preserves acr across rotation. If a step-up access-token leaks, the only brake is the short access-token TTL (or [M2] — shorter TTL when acr=aal2).

Tuple Fields§

§0: AuthClaims

StepUpAuth

Struct StepUpAuth Copy item path

Tuple Fields§

Trait Implementations§

impl Clone for StepUpAuth

fn clone(&self) -> StepUpAuth

fn clone_from(&mut self, source: &Self)

impl Debug for StepUpAuth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

impl<S: AuthState> FromRequestParts<S> for StepUpAuth

type Rejection = AppError

async fn from_request_parts( parts: &mut Parts, state: &S, ) -> Result<Self, Self::Rejection>

Auto Trait Implementations§

impl Freeze for StepUpAuth

impl RefUnwindSafe for StepUpAuth

impl Send for StepUpAuth

impl Sync for StepUpAuth

impl Unpin for StepUpAuth

impl UnsafeUnpin for StepUpAuth

impl UnwindSafe for StepUpAuth

Blanket Implementations§

impl<T> Any for Twhere T: 'static + ?Sized,

fn type_id(&self) -> TypeId

impl<T> At for T

fn at<M>(self, metadata: M) -> Meta<T, M>

impl<T> Borrow<T> for Twhere T: ?Sized,

fn borrow(&self) -> &T

impl<T> BorrowMut<T> for Twhere T: ?Sized,

fn borrow_mut(&mut self) -> &mut T

impl<T> BorrowStripped for T

fn stripped(&self) -> &Stripped<T>

impl<T> BorrowUnordered for T

fn as_unordered(&self) -> &Unordered<T>

impl<ST, DT> CastableFrom<ST, Initialized, Initialized> for DTwhere ST: ?Sized, DT: ?Sized,

impl<ST, DT> CastableFrom<ST, Uninit, Uninit> for DTwhere ST: ?Sized, DT: ?Sized,

impl<T> CloneToUninit for Twhere T: Clone,

unsafe fn clone_to_uninit(&self, dest: *mut u8)

impl<T> From<T> for T

fn from(t: T) -> T

impl<T> FromRef<T> for Twhere T: Clone,

fn from_ref(input: &T) -> T

impl<S, T> FromRequest<S, ViaParts> for Twhere S: Send + Sync, T: FromRequestParts<S>,

type Rejection = <T as FromRequestParts<S>>::Rejection

fn from_request( req: Request<Body>, state: &S, ) -> impl Future<Output = Result<T, <T as FromRequest<S, ViaParts>>::Rejection>>

impl<T, C> FromWithContext<T, C> for T

fn from_with(value: T, _context: &C) -> T

impl<T> Instrument for T

fn instrument(self, span: Span) -> Instrumented<Self>

fn in_current_span(self) -> Instrumented<Self>

impl<T, U> Into<U> for Twhere U: From<T>,

fn into(self) -> U

impl<T, U, C> IntoWithContext<U, C> for Twhere U: FromWithContext<T, C>,

fn into_with(self, context: &C) -> U

impl<T> Pointable for T

const ALIGN: usize

type Init = T

unsafe fn init(init: <T as Pointable>::Init) -> usize

unsafe fn deref<'a>(ptr: usize) -> &'a T

unsafe fn deref_mut<'a>(ptr: usize) -> &'a mut T

unsafe fn drop(ptr: usize)

impl<T> PolicyExt for Twhere T: ?Sized,

fn and<P, B, E>(self, other: P) -> And<T, P>where T: Sized + Policy<B, E>, P: Policy<B, E>,

fn or<P, B, E>(self, other: P) -> Or<T, P>where T: Sized + Policy<B, E>, P: Policy<B, E>,

impl<T> Read<Exclusive, BecauseExclusive> for Twhere T: ?Sized,

impl<T> ResourceProvider<()> for T

fn get_resource(&self) -> &()

impl<T> Same for T

type Output = T

impl<T> ToOwned for Twhere T: Clone,

type Owned = T

fn to_owned(&self) -> T

fn clone_into(&self, target: &mut T)

impl<T> ToOwned for T

type Owned = T

impl<T, U> TryFrom<U> for Twhere U: Into<T>,

type Error = Infallible

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

impl<T, U, C> TryFromWithContext<U, C> for Twhere U: IntoWithContext<T, C>,

type Error = Infallible

fn try_from_with( value: U, context: &C, ) -> Result<T, <T as TryFromWithContext<U, C>>::Error>

Struct StepUpAuth

impl<T> Any for T
where T: 'static + ?Sized,

impl<T> Borrow<T> for T
where T: ?Sized,

impl<T> BorrowMut<T> for T
where T: ?Sized,

impl<ST, DT> CastableFrom<ST, Initialized, Initialized> for DT
where ST: ?Sized, DT: ?Sized,

impl<ST, DT> CastableFrom<ST, Uninit, Uninit> for DT
where ST: ?Sized, DT: ?Sized,

impl<T> CloneToUninit for T
where T: Clone,

impl<T> FromRef<T> for T
where T: Clone,

impl<S, T> FromRequest<S, ViaParts> for T
where S: Send + Sync, T: FromRequestParts<S>,

impl<T, U> Into<U> for T
where U: From<T>,

impl<T, U, C> IntoWithContext<U, C> for T
where U: FromWithContext<T, C>,

impl<T> PolicyExt for T
where T: ?Sized,

fn and<P, B, E>(self, other: P) -> And<T, P>
where T: Sized + Policy<B, E>, P: Policy<B, E>,

fn or<P, B, E>(self, other: P) -> Or<T, P>
where T: Sized + Policy<B, E>, P: Policy<B, E>,

impl<T> Read<Exclusive, BecauseExclusive> for T
where T: ?Sized,

impl<T> ToOwned for T
where T: Clone,

impl<T, U> TryFrom<U> for T
where U: Into<T>,

impl<T, U, C> TryFromWithContext<U, C> for T
where U: IntoWithContext<T, C>,

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

impl<T, U, C> TryIntoWithContext<U, C> for T
where U: TryFromWithContext<T, C>,

impl<S, T> Upcast<T> for S
where T: UpcastFrom<S> + ?Sized, S: ?Sized,

fn upcast(&self) -> &T
where Self: ErasableGeneric, T: Sized + ErasableGeneric<Repr = Self::Repr>,

fn upcast_into(self) -> T
where Self: Sized + ErasableGeneric, T: Sized + ErasableGeneric<Repr = Self::Repr>,

impl<V, T> VZip<V> for T
where V: MultiLane<T>,

impl<T> WithContext for T
where T: ?Sized,

fn into_with<C>(self, context: C) -> Contextual<T, C>
where T: Sized,

fn with_subscriber<S>(self, subscriber: S) -> WithDispatch<Self>
where S: Into<Dispatch>,