yeti_types/

auth.rs

//! Authentication and authorization framework types.
//!
//! Defines: `AuthError`, `AuthIdentity`, `Access` (closed enum, the
//! request authorization decision), the RBAC value tree
//! (`User`/`Role`/`Permission`/`DatabasePermission`/`TablePermission`/
//! `AttributePermission`), `AuthProvider` (plugin extension for
//! authentication — produces `AuthIdentity`), `AuthPipeline`,
//! `CookieJar`.

use async_trait::async_trait;
use bytes::Bytes;
use http::Request;
use serde::{Deserialize, Serialize};
use std::borrow::Cow;
use std::collections::HashMap;
use std::sync::Arc;

use crate::backend::BackendManager;

// ============================================================================
// AuthError
// ============================================================================

/// Authentication error.
#[derive(Debug, Clone)]
pub enum AuthError {
    /// Invalid credentials
    InvalidCredentials,
    /// User not found
    UserNotFound,
    /// User inactive
    UserInactive,
    /// Token expired
    TokenExpired,
    /// Invalid token
    InvalidToken,
    /// Internal error
    InternalError(String),
}

impl std::fmt::Display for AuthError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::InvalidCredentials => write!(f, "Invalid credentials"),
            Self::UserNotFound => write!(f, "User not found"),
            Self::UserInactive => write!(f, "User inactive"),
            Self::TokenExpired => write!(f, "Token expired"),
            Self::InvalidToken => write!(f, "Invalid token"),
            Self::InternalError(msg) => write!(f, "Internal error: {msg}"),
        }
    }
}

impl std::error::Error for AuthError {}

// ============================================================================
// AuthIdentity
// ============================================================================

/// Authentication identity — the result of successful authentication.
///
/// Represents WHO the user is (authentication), not what they can do
/// (authorization). Mapped to a `User` with `Role` per-application
/// during authorization.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum AuthIdentity {
    /// Basic auth user (username verified via password)
    Basic {
        /// Username from Basic auth header
        username: String,
    },

    /// JWT auth user (username from validated token)
    Jwt {
        /// Username (sub claim)
        username: String,
        /// Full JWT claims for additional context
        claims: serde_json::Value,
    },

    /// OAuth user (identity from external provider)
    OAuth {
        /// Email address (if provided by provider)
        email: Option<String>,
        /// OAuth provider name (github, google, azure, etc.)
        provider: String,
        /// Full OAuth claims/user info
        claims: serde_json::Value,
    },

    /// mTLS user (identity from client certificate)
    Mtls {
        /// Username (mapped from CN, SAN, or config)
        username: String,
        /// Certificate Common Name
        cn: String,
        /// Subject Alternative Names
        sans: Vec<String>,
    },
}

impl AuthIdentity {
    /// Get the username/identifier for this identity.
    ///
    /// Returns a borrowed `&str` for most variants. The OAuth fallback
    /// (no email) allocates a formatted string, so the return type is
    /// `Cow<str>` to avoid cloning in the common case.
    #[must_use]
    pub fn username(&self) -> Cow<'_, str> {
        match self {
            Self::Basic { username } => Cow::Borrowed(username),
            Self::Jwt { username, .. } => Cow::Borrowed(username),
            Self::OAuth {
                email, provider, ..
            } => email.as_ref().map_or_else(
                || Cow::Owned(format!("oauth:{provider}")),
                |e| Cow::Borrowed(e.as_str()),
            ),
            Self::Mtls { username, .. } => Cow::Borrowed(username),
        }
    }

    /// Get the auth method name.
    #[must_use]
    pub const fn method(&self) -> &'static str {
        match self {
            Self::Basic { .. } => "basic",
            Self::Jwt { .. } => "jwt",
            Self::OAuth { .. } => "oauth",
            Self::Mtls { .. } => "mtls",
        }
    }
}

// ============================================================================
// CookieJar
// ============================================================================

/// Simple cookie jar abstraction for auth providers.
#[derive(Debug, Clone, Default)]
pub struct CookieJar {
    cookies: HashMap<String, String>,
}

impl CookieJar {
    /// Create empty cookie jar.
    #[must_use]
    pub fn new() -> Self {
        Self::default()
    }

    /// Parse cookies from request headers.
    ///
    /// Uses `get_all("Cookie")` to handle HTTP/2 split Cookie headers.
    pub fn from_request<B>(req: &Request<B>) -> Self {
        let mut cookies = HashMap::new();

        for cookie_header in req.headers().get_all("Cookie") {
            if let Ok(cookie_str) = cookie_header.to_str() {
                for cookie in cookie_str.split(';') {
                    let cookie = cookie.trim();
                    if let Some((name, value)) = cookie.split_once('=') {
                        cookies.insert(name.to_owned(), value.to_owned());
                    }
                }
            }
        }

        Self { cookies }
    }

    /// Get a cookie value by name.
    #[must_use]
    pub fn get(&self, name: &str) -> Option<&str> {
        self.cookies.get(name).map(std::string::String::as_str)
    }

    /// Set a cookie value (for testing).
    pub fn set(&mut self, name: impl Into<String>, value: impl Into<String>) {
        self.cookies.insert(name.into(), value.into());
    }
}

// ============================================================================
// RBAC value types (moved from yeti-auth 2026-05-14, Context-contract
// option 1: closed enum, no dynamic dispatch on the request hot path).
//
// User / Role / Permission live at L0 so Context can hold them by
// value without a dyn-trait indirection. yeti-auth keeps its own auth
// flow (login / OAuth / JWT) and re-exports these types for the
// pre-refactor import paths.
// ============================================================================

/// Reserved role id for the platform's built-in unrestricted role.
pub const ROLE_SUPER_USER: &str = "super_user";

/// Per-attribute permission flags.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AttributePermission {
    /// Allow reading this attribute.
    pub read: bool,
    /// Allow writing this attribute.
    pub write: bool,
}

/// Table-level CRUD permission grants.
///
/// Each bool maps 1:1 to a CRUD verb. `attribute_permissions` is a
/// per-field override map: if a field appears with `read=false`, the
/// field is hidden from the response even when `read=true` at the
/// table level.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
#[expect(
    clippy::struct_excessive_bools,
    reason = "RBAC DTO; each bool maps 1:1 to a CRUD verb (read, insert, update, delete) — these are user-visible permission flags configured per-role in the auth manifest. Bitflags would diverge from the manifest serialization shape."
)]
pub struct TablePermission {
    /// Allow reading records.
    pub read: bool,
    /// Allow inserting records.
    pub insert: bool,
    /// Allow updating records.
    pub update: bool,
    /// Allow deleting records.
    pub delete: bool,
    /// Per-attribute permission overrides.
    #[serde(default)]
    pub attribute_permissions: HashMap<String, AttributePermission>,
}

/// Database-level permissions — owns a per-table grant map.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct DatabasePermission {
    /// Per-table permission grants.
    pub tables: HashMap<String, TablePermission>,
}

/// Role permissions — owns a per-database permission tree plus the
/// platform-wide `super_user` toggle.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct Permission {
    /// Whether this role has unrestricted access.
    #[serde(default)]
    pub super_user: bool,
    /// Per-database permission grants.
    #[serde(default)]
    pub databases: HashMap<String, DatabasePermission>,
}

/// Named role assignable to a user.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Role {
    /// Unique role identifier.
    pub id: String,
    /// Human-readable role name.
    pub name: String,
    /// Permission grants for this role.
    pub permissions: Permission,
}

/// Authenticated user — username + assigned role. Held inside
/// [`Access::User`] when a request has been authenticated; the
/// `Arc` keeps `Access` cheap to clone across the pipeline.
#[derive(Debug, Clone)]
pub struct User {
    /// The user's login name.
    pub username: String,
    /// The user's assigned role.
    pub role: Role,
}

impl User {
    /// Build a user with the given role.
    #[must_use]
    pub const fn new(username: String, role: Role) -> Self {
        Self { username, role }
    }

    /// Build a user with the built-in `super_user` role.
    #[must_use]
    pub fn super_user(username: String) -> Self {
        Self {
            username,
            role: Role {
                id: ROLE_SUPER_USER.to_owned(),
                name: "Super User".to_owned(),
                permissions: Permission {
                    super_user: true,
                    databases: HashMap::new(),
                },
            },
        }
    }

    /// Resolve the table grant for `(database, table)`, trying an
    /// exact match first and falling back to a case-insensitive
    /// table-name match (roles use schema-declared `PascalCase`; URLs
    /// can come in lowercase).
    fn table_perm(&self, database: &str, table: &str) -> Option<&TablePermission> {
        let db = self.role.permissions.databases.get(database)?;
        db.tables.get(table).or_else(|| {
            let lower = table.to_lowercase();
            db.tables
                .iter()
                .find(|(k, _)| k.to_lowercase() == lower)
                .map(|(_, v)| v)
        })
    }

    /// `true` if this user's role has `super_user = true`.
    #[must_use]
    pub const fn is_super_user(&self) -> bool {
        self.role.permissions.super_user
    }

    /// Role identifier (`Role.id`).
    #[must_use]
    pub fn role(&self) -> &str {
        &self.role.id
    }

    /// Username.
    #[must_use]
    pub fn username(&self) -> &str {
        &self.username
    }

    /// May this user read records from `database.table`?
    #[must_use]
    pub fn can_read_table(&self, database: &str, table: &str) -> bool {
        if self.is_super_user() {
            return true;
        }
        self.table_perm(database, table).is_some_and(|t| t.read)
    }

    /// May this user insert records into `database.table`?
    #[must_use]
    pub fn can_insert_table(&self, database: &str, table: &str) -> bool {
        if self.is_super_user() {
            return true;
        }
        self.table_perm(database, table).is_some_and(|t| t.insert)
    }

    /// May this user update records in `database.table`?
    #[must_use]
    pub fn can_update_table(&self, database: &str, table: &str) -> bool {
        if self.is_super_user() {
            return true;
        }
        self.table_perm(database, table).is_some_and(|t| t.update)
    }

    /// May this user delete records from `database.table`?
    #[must_use]
    pub fn can_delete_table(&self, database: &str, table: &str) -> bool {
        if self.is_super_user() {
            return true;
        }
        self.table_perm(database, table).is_some_and(|t| t.delete)
    }

    /// May this user read field `attr` on `database.table`?
    #[must_use]
    pub fn can_read_attribute(&self, database: &str, table: &str, attr: &str) -> bool {
        if self.is_super_user() {
            return true;
        }
        if !self.can_read_table(database, table) {
            return false;
        }
        self.table_perm(database, table)
            .and_then(|t| t.attribute_permissions.get(attr))
            .is_none_or(|a| a.read)
    }

    /// May this user write field `attr` on `database.table`?
    #[must_use]
    pub fn can_write_attribute(&self, database: &str, table: &str, attr: &str) -> bool {
        if self.is_super_user() {
            return true;
        }
        let table_perm = self.table_perm(database, table);
        let can_write_table = table_perm.is_some_and(|t| t.insert || t.update);
        if !can_write_table {
            return false;
        }
        table_perm
            .and_then(|t| t.attribute_permissions.get(attr))
            .is_none_or(|a| a.write)
    }

    /// `true` if no per-attribute restrictions apply for `database.table`.
    #[must_use]
    pub fn has_unrestricted_attributes(&self, database: &str, table: &str) -> bool {
        if self.is_super_user() {
            return true;
        }
        // No table perm OR table perm with empty attribute map means
        // attributes are unrestricted at the table level.
        self.table_perm(database, table)
            .is_none_or(|t| t.attribute_permissions.is_empty())
    }
}

// ============================================================================
// Access — the request-context authorization decision (closed enum).
// ============================================================================

/// Authorization decision attached to a request `Context`.
///
/// Closed enum (no `dyn`): the dispatch layer reads
/// `ctx.access.can_read_table(db, t)` and the compiler devirtualizes
/// to a stack-resident match. Customer authentication plugins extend
/// via [`AuthProvider`] — they produce an [`AuthIdentity`] which the
/// framework resolves into a `User`; they do not implement Access
/// directly.
#[derive(Debug, Clone, Default)]
pub enum Access {
    /// Unauthenticated request. Every permission check returns
    /// `false`; the only way through is a resource that explicitly
    /// opts into public access (e.g. via `@access(public: [read])`).
    #[default]
    None,
    /// Authenticated user — RBAC decisions delegate to the inner
    /// [`User`]. Wrapped in `Arc` so cloning `Access` across the
    /// request pipeline is one atomic bump, not a deep `Role` copy.
    User(Arc<User>),
}

impl Access {
    /// `true` if the request authenticated as a user (any user).
    #[must_use]
    pub const fn is_authenticated(&self) -> bool {
        matches!(self, Self::User(_))
    }

    /// `true` if the request authenticated as a super-user role.
    #[must_use]
    pub fn is_super_user(&self) -> bool {
        match self {
            Self::None => false,
            Self::User(u) => u.is_super_user(),
        }
    }

    /// Role identifier of the authenticated user, or empty string
    /// if unauthenticated.
    #[must_use]
    pub fn role(&self) -> &str {
        match self {
            Self::None => "",
            Self::User(u) => u.role(),
        }
    }

    /// Username of the authenticated user, or empty string if
    /// unauthenticated.
    #[must_use]
    pub fn username(&self) -> &str {
        match self {
            Self::None => "",
            Self::User(u) => u.username(),
        }
    }

    /// `Some(user)` if authenticated, `None` otherwise. Useful when
    /// the caller needs to reach into User-specific fields beyond
    /// the helper methods on Access.
    #[must_use]
    pub fn user(&self) -> Option<&User> {
        match self {
            Self::None => None,
            Self::User(u) => Some(u),
        }
    }

    /// May the requester read records from `database.table`?
    #[must_use]
    pub fn can_read_table(&self, database: &str, table: &str) -> bool {
        match self {
            Self::None => false,
            Self::User(u) => u.can_read_table(database, table),
        }
    }

    /// May the requester insert records into `database.table`?
    #[must_use]
    pub fn can_insert_table(&self, database: &str, table: &str) -> bool {
        match self {
            Self::None => false,
            Self::User(u) => u.can_insert_table(database, table),
        }
    }

    /// May the requester update records in `database.table`?
    #[must_use]
    pub fn can_update_table(&self, database: &str, table: &str) -> bool {
        match self {
            Self::None => false,
            Self::User(u) => u.can_update_table(database, table),
        }
    }

    /// May the requester delete records from `database.table`?
    #[must_use]
    pub fn can_delete_table(&self, database: &str, table: &str) -> bool {
        match self {
            Self::None => false,
            Self::User(u) => u.can_delete_table(database, table),
        }
    }

    /// May the requester read field `attr` on `database.table`?
    #[must_use]
    pub fn can_read_attribute(&self, database: &str, table: &str, attr: &str) -> bool {
        match self {
            Self::None => false,
            Self::User(u) => u.can_read_attribute(database, table, attr),
        }
    }

    /// May the requester write field `attr` on `database.table`?
    #[must_use]
    pub fn can_write_attribute(&self, database: &str, table: &str, attr: &str) -> bool {
        match self {
            Self::None => false,
            Self::User(u) => u.can_write_attribute(database, table, attr),
        }
    }

    /// `true` if no per-attribute restrictions apply for `database.table`.
    /// `Access::None` returns `true` here because there is no user
    /// whose attribute grants need consulting — callers gate on
    /// [`is_authenticated`](Self::is_authenticated) separately if they
    /// need to distinguish "no user" from "user with full attributes".
    #[must_use]
    pub fn has_unrestricted_attributes(&self, database: &str, table: &str) -> bool {
        match self {
            Self::None => true,
            Self::User(u) => u.has_unrestricted_attributes(database, table),
        }
    }

    /// Filter `attrs` to only those the requester may read on
    /// `database.table`. Super-users keep the full list; unauthenticated
    /// requests get an empty list.
    #[must_use]
    pub fn filter_readable_attributes<'a>(
        &self,
        database: &str,
        table: &str,
        attrs: &[&'a str],
    ) -> Vec<&'a str> {
        match self {
            Self::None => Vec::new(),
            Self::User(u) => {
                if u.is_super_user() {
                    return attrs.to_vec();
                }
                attrs
                    .iter()
                    .filter(|a| u.can_read_attribute(database, table, a))
                    .copied()
                    .collect()
            },
        }
    }

    /// Verify every attribute in `attrs` is writable. Super-users
    /// always succeed; unauthenticated requests fail listing every
    /// attribute as unauthorized.
    ///
    /// # Errors
    ///
    /// Returns `Err(unauthorized)` with the list of attribute names
    /// the requester may not write.
    pub fn validate_writable_attributes(
        &self,
        database: &str,
        table: &str,
        attrs: &[&str],
    ) -> std::result::Result<(), Vec<String>> {
        match self {
            Self::None => Err(attrs.iter().map(|s| (*s).to_owned()).collect()),
            Self::User(u) => {
                if u.is_super_user() {
                    return Ok(());
                }
                let unauthorized: Vec<String> = attrs
                    .iter()
                    .filter(|a| !u.can_write_attribute(database, table, a))
                    .map(|s| (*s).to_owned())
                    .collect();
                if unauthorized.is_empty() {
                    Ok(())
                } else {
                    Err(unauthorized)
                }
            },
        }
    }

    /// Filter a JSON object in-place, retaining only attributes the
    /// requester may read. Super-users pass-through. Unauthenticated
    /// requests reduce the object to empty.
    pub fn filter_record(&self, database: &str, table: &str, record: &mut serde_json::Value) {
        match self {
            Self::None => {
                if let Some(obj) = record.as_object_mut() {
                    obj.clear();
                }
            },
            Self::User(u) => {
                if u.is_super_user() {
                    return;
                }
                if let Some(obj) = record.as_object_mut() {
                    obj.retain(|key, _| u.can_read_attribute(database, table, key));
                }
            },
        }
    }

    /// Filter every record in `records` via [`filter_record`](Self::filter_record).
    pub fn filter_records(&self, database: &str, table: &str, records: &mut [serde_json::Value]) {
        for record in records {
            self.filter_record(database, table, record);
        }
    }
}

// ============================================================================
// AuthProvider trait
// ============================================================================

/// Authentication provider trait.
///
/// Providers are run in priority order (highest first) until one returns
/// an identity.
#[async_trait]
pub trait AuthProvider: Send + Sync {
    /// Attempt to authenticate the request.
    ///
    /// Returns:
    /// - `Ok(Some(identity))` if credentials are valid
    /// - `Ok(None)` if this provider doesn't apply
    /// - `Err(...)` if credentials are present but invalid
    async fn authenticate(
        &self,
        req: &Request<Bytes>,
        cookies: &CookieJar,
        backend: Option<&BackendManager>,
    ) -> std::result::Result<Option<AuthIdentity>, AuthError>;

    /// Priority for ordering (higher = checked first).
    fn priority(&self) -> i32 {
        100
    }

    /// Name for logging and debugging.
    fn name(&self) -> &str;
}

// ============================================================================
// AuthLifecycleHook
// ============================================================================

/// Minimal user view handed to lifecycle hooks.
///
/// The legacy static OAuth/JWT path doesn't always have a fully
/// resolved [`User`] (with a populated [`Role`]) at every hook site —
/// login fires before role resolution, logout only knows the session
/// subject. `LifecycleUser` is the common denominator both paths can
/// always produce: a username plus the optional email + provider that
/// were available. Hooks that need the full RBAC role read it from the
/// `Context` they receive elsewhere.
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct LifecycleUser {
    /// Stable subject identifier (username / `sub`).
    pub username: String,
    /// Email, when the authenticating path knew it.
    pub email: Option<String>,
    /// Authenticating provider (`"github"`, `"google"`, `"basic"`,
    /// `"jwt"`, …) when known.
    pub provider: Option<String>,
}

impl LifecycleUser {
    /// Build a `LifecycleUser` from a username only.
    #[must_use]
    pub fn from_username(username: impl Into<String>) -> Self {
        Self {
            username: username.into(),
            email: None,
            provider: None,
        }
    }

    /// Derive a `LifecycleUser` from an [`AuthIdentity`].
    #[must_use]
    pub fn from_identity(identity: &AuthIdentity) -> Self {
        let provider = Some(identity.method().to_owned());
        match identity {
            AuthIdentity::OAuth {
                email, provider: p, ..
            } => Self {
                username: identity.username().into_owned(),
                email: email.clone(),
                provider: Some(p.clone()),
            },
            _ => Self {
                username: identity.username().into_owned(),
                email: None,
                provider,
            },
        }
    }
}

/// Token data surfaced to [`AuthLifecycleHook::on_token_refresh`].
///
/// Refresh fires after a provider hands back a fresh access token; the
/// hook gets the new bearer plus its remaining lifetime so it can
/// re-prime downstream caches / re-issue derived credentials.
#[derive(Debug, Clone, Default)]
pub struct LifecycleToken {
    /// The freshly-minted provider access token.
    pub access_token: String,
    /// Remaining TTL in seconds, when the provider reported one.
    pub expires_in: Option<u64>,
}

/// Auth lifecycle hook — fires on login, logout, and token refresh of
/// the **legacy static** auth path (Basic / JWT / OAuth session).
///
/// This is the successor to the deleted `AuthHook::on_resolve_role`
/// trait (removed in ADR-006, which moved *role resolution* to the
/// `tower::Service<ResolveRequest>` plugin surface). Role resolution
/// is intentionally NOT part of this trait — that concern already has
/// a home. What had no home was the request to observe the
/// authentication *events themselves* (`on_login`, `on_logout`,
/// `on_token_refresh`); this trait fills exactly that gap.
///
/// All methods default to no-ops so implementors override only what
/// they care about. Hooks are observational: they cannot deny a login
/// (the auth posture is decided before they run) — returning is the
/// only contract. They run after the security decision, never as part
/// of it, so a buggy or slow hook can never weaken authentication.
#[async_trait]
pub trait AuthLifecycleHook: Send + Sync {
    /// Hook name for logging / debugging.
    fn name(&self) -> &'static str {
        "anonymous"
    }

    /// Fired after a user successfully authenticates and a session /
    /// token is issued. Default no-op.
    async fn on_login(&self, _user: &LifecycleUser) {}

    /// Fired after a user's session / token is invalidated. Default no-op.
    async fn on_logout(&self, _user: &LifecycleUser) {}

    /// Fired after an OAuth access token is proactively or explicitly
    /// refreshed. Default no-op.
    async fn on_token_refresh(&self, _user: &LifecycleUser, _token: &LifecycleToken) {}
}

// ============================================================================
// AuthPipeline
// ============================================================================

/// Authentication pipeline — runs providers in priority order.
pub struct AuthPipeline {
    providers: Vec<Arc<dyn AuthProvider>>,
}

impl std::fmt::Debug for AuthPipeline {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("AuthPipeline")
            .field("providers", &self.providers.len())
            .finish_non_exhaustive()
    }
}

impl Default for AuthPipeline {
    fn default() -> Self {
        Self::new()
    }
}

impl AuthPipeline {
    /// Create empty auth pipeline.
    #[must_use]
    pub fn new() -> Self {
        Self {
            providers: Vec::new(),
        }
    }

    /// Register an auth provider (sorted by priority — highest first).
    pub fn register(&mut self, provider: Arc<dyn AuthProvider>) {
        self.providers.push(provider);
        self.providers
            .sort_by_key(|p| std::cmp::Reverse(p.priority()));
    }

    /// Register an auth provider in caller-determined order (no sorting).
    pub fn register_ordered(&mut self, provider: Arc<dyn AuthProvider>) {
        self.providers.push(provider);
    }

    /// Get number of registered providers.
    #[must_use]
    pub fn len(&self) -> usize {
        self.providers.len()
    }

    /// Check if pipeline is empty.
    #[must_use]
    pub fn is_empty(&self) -> bool {
        self.providers.is_empty()
    }

    /// Run authentication — returns identity if any provider succeeds.
    pub async fn authenticate(
        &self,
        req: &Request<Bytes>,
        cookies: &CookieJar,
        backend: Option<&BackendManager>,
        app_id: &str,
    ) -> Option<AuthIdentity> {
        let mut had_error = false;
        for provider in &self.providers {
            match provider.authenticate(req, cookies, backend).await {
                Ok(Some(identity)) => {
                    tracing::debug!(
                        "[{}] Authenticated via {} as {}",
                        app_id,
                        provider.name(),
                        identity.username()
                    );
                    return Some(identity);
                },
                Ok(None) => {},
                Err(e) => {
                    tracing::error!(
                        "[{}] Auth provider {} error: {}",
                        app_id,
                        provider.name(),
                        e
                    );
                    had_error = true;
                },
            }
        }

        if had_error {
            tracing::error!(
                "[{}] All auth providers failed or returned no identity",
                app_id
            );
        } else {
            tracing::trace!("[{}] No authentication credentials provided", app_id);
        }
        None
    }
}

// `tower::Service<ResolveRequest, Response = ResolveResponse>` — see
// `crate::plugins::auth`.