Module auth 

RPC inbound authentication: the daemon-side bundle of the provider registry, the shared principal resolver, and the live local-identity bindings, consumed by the initialize handshake and the per-method authorization gate.

Credential routing (RFC 7141 Rev 8) is explicit:

• an auth_token in the handshake selects the provider named by auth_provider, defaulting to native (the pairing token) when unnamed — a fixed selection, never a scan across providers, and the selected provider’s denial is final;
• with no token, a kernel-supplied peer credential routes to the one peercred provider;
• with neither, only a LOCAL connection with no [users] roster configured keeps the legacy trusted path (the socket mode / pipe ACL is the credential). Once a roster exists, or on any remote connection, no credential means denial — never shared-operator fallback.

The compiled policy is generation-stamped: refresh_from_config swaps the resolver policy and the uid roster together, so profile, mapping, and roster edits reach established connections at their next privileged operation.

Structs

AcceptedAuthState

The daemon’s inbound-auth layer: providers, resolver, and live local bindings. One instance per daemon generation, shared by every connection.

AuthDenied

A handshake or authorization denial, pre-mapped to its JSON-RPC error.

AuthorityLease

The accepted authorization state and the paired-token set, held still by RpcInboundAuth::hold_authority.

ConnectionAuth

The authenticated state one connection holds after initialize. Grants are a stamped resolution, not a snapshot: the gate re-resolves from identity whenever the authorization generation moves.

RpcInboundAuth

The daemon’s inbound-auth layer. The accepted state is a single snapshot: registry, resolver/generation, uid roster, and local trust posture are rebuilt and published together or not at all.

Enums

LocalCredentialEvidence

Only non-secret, local authentication evidence retained on a connection.

Functions

validate_accepted_auth_config

Prove that an authorization policy compiles, without a live auth layer in hand.