Enum IdentitySubject 

#[non_exhaustive]
pub enum IdentitySubject {
    SharedOperator,
    Oidc {
        issuer: String,
        subject: String,
    },
    Service {
        issuer: String,
        client_id: String,
    },
    Roster {
        principal_id: String,
    },
}

The verified subject of an AuthenticatedIdentity. Each variant carries exactly the fields its canonical PrincipalId is composed from, so a provider cannot construct an ambiguous or cross-class identity.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

SharedOperator

Explicitly-trusted shared operator (native pairing token, or the daemon’s own uid on the local socket). Trusted, but NOT a distinct authenticated identity.

Oidc

An OIDC human identity. issuer is the VALIDATED iss; subject the validated sub.

Fields

issuer: String

subject: String

Service

An OIDC service principal. client_id is the stable verified client identity from the validated token/introspection response.

Fields

issuer: String

client_id: String

Roster

A local roster identity: the durable [users.<name>] principal id the credential mapped to through explicit configuration.

Fields

principal_id: String

Implementations

impl IdentitySubject

pub fn principal_id(&self) -> PrincipalId

The canonical principal id this subject resolves to. One composition rule, owned here — providers and the resolver cannot disagree.

pub fn actor_kind(&self) -> ActorKind

The actor kind this subject implies.

pub fn trust_domain(&self) -> &str

The trust domain recorded on the resolved principal: the validated issuer for OIDC identities, local for roster identities, native for the shared operator.

pub fn display_id(&self) -> &str

A human-readable, non-authoritative display identifier (OIDC sub, roster principal id, service client_id).

Trait Implementations

impl Clone for IdentitySubject

fn clone(&self) -> IdentitySubject

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IdentitySubject

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for IdentitySubject

impl PartialEq for IdentitySubject

fn eq(&self, other: &IdentitySubject) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for IdentitySubject