Struct AuthenticatedIdentity 

#[non_exhaustive]
pub struct AuthenticatedIdentity {
    pub subject: IdentitySubject,
    pub method: AuthMethod,
    pub provider_alias: Option<String>,
    pub claims: Map<String, Value>,
    pub mfa_verified: bool,
    pub expires_at: Option<u64>,
    pub revalidate_by: Option<u64>,
}

What an auth provider outputs after verifying ONE credential: identity and evidence, never grants. Handshake-scoped and server-side only — this type is deliberately not serializable, and its Debug never prints claim values (claims may carry personal data).

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

subject: IdentitySubject

The verified subject.

method: AuthMethod

How the credential was verified.

provider_alias: Option<String>

The configured provider alias that verified it (e.g. corp for [oidc.corp]). None for providers with no config alias.

claims: Map<String, Value>

Verified claims, as mapping INPUTS for the shared resolver’s explicit claim-to-profile mapping. Empty for local/native identities. Never retained on the resolved Principal.

mfa_verified: bool

Whether the identity source attested a completed second factor.

expires_at: Option<u64>

Credential expiry (UNIX seconds). None = the provider imposes none.

revalidate_by: Option<u64>

Provider-specific revalidation deadline (UNIX seconds): the moment after which the next privileged operation must revalidate or fail closed. None = no revalidation requirement beyond expires_at.

Implementations

impl AuthenticatedIdentity

pub fn new(subject: IdentitySubject, method: AuthMethod) -> Self

Construct with empty claims and no expiry. Providers attach evidence via the with_* builders (the struct is #[non_exhaustive]).

pub fn shared_operator(method: AuthMethod) -> Self

The trusted shared operator (native pairing / same-uid local peer).

pub fn with_provider_alias(self, alias: impl Into<String>) -> Self

pub fn with_claims(self, claims: Map<String, Value>) -> Self

pub fn with_mfa_verified(self, mfa_verified: bool) -> Self

pub fn with_expires_at(self, expires_at: u64) -> Self

pub fn with_revalidate_by(self, revalidate_by: u64) -> Self

pub fn provider_label(&self) -> String

The audit label for the verifying provider: <type>.<alias> when a config alias exists, else the bare method label.

Trait Implementations

impl Clone for AuthenticatedIdentity

fn clone(&self) -> AuthenticatedIdentity

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthenticatedIdentity

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.