Struct RpcInboundAuth 

pub struct RpcInboundAuth { /* private fields */ }

The daemon’s inbound-auth layer. The accepted state is a single snapshot: registry, resolver/generation, uid roster, and local trust posture are rebuilt and published together or not at all.

Implementations

impl RpcInboundAuth

pub fn from_config(config: &Config, pairing: Arc<PairingGuard>) -> Result<Self>

pub fn for_tests(config: &Config) -> Arc<Self>

Test-only permissive layer: empty auth config, fresh pairing guard. Local connections resolve through the legacy shared-operator path.

pub fn generation(&self) -> u64

Current authorization generation from the accepted snapshot.

pub fn resolve( &self, identity: &AuthenticatedIdentity, ) -> Result<ResolvedPrincipal, DenyReason>

Resolve against one coherent accepted snapshot.

pub fn pairing(&self) -> &Arc<PairingGuard>

The live pairing authority, for per-operation revocation checks.

pub fn provider_names(&self) -> Vec<String>

The handshake’s advertised provider names.

pub fn refresh_from_config(&self, config: &Config) -> Result<u64>

Re-compile policy from the current config: resolver policy, uid roster, and the roster-configured flag move together, and every previously stamped generation becomes stale. Returns the new generation.

The resolver validates and installs FIRST: if the auth sections are invalid it returns the error and nothing here changes — the previous policy, roster, flags, and generation all stay in effect.

pub fn accepted_revision(&self) -> u64

The revision of the configuration the accepted state was built from.

pub fn publish_accepted(&self, config: &Config, revision: u64) -> Result<u64>

Publish an accepted policy built from a configuration that has been persisted as revision.

Takes the same write lock over the accepted state that Self::refresh_from_config takes, so the state and the revision it carries are installed together. A revision that is not newer than the accepted one is refused as a no-op and the current generation is returned, which is what keeps a writer that was slow to publish from reinstalling superseded policy over a newer one.

A persistence that leaves every authorization input as it was (see auth_inputs) records its revision without moving the generation. Nothing the accepted state is compiled from changed, and moving the generation would make every established binding re-resolve over an unrelated edit, which an OIDC binding cannot survive.

Returns the generation in force after the call.

pub fn accepted_at_least( &self, revision: u64, ) -> Result<Arc<AcceptedAuthState>, DenyReason>

The accepted state, but only once it has caught up to revision.

Fail-closed: a consumer that needs to act on a policy it just persisted gets a denial rather than the previous state when the publication has not landed yet.

pub fn validate_refresh_from_config(&self, config: &Config) -> Result<()>

Prove that an auth snapshot can be compiled before a caller persists a config edit. The caller still uses Self::refresh_from_config to publish it after the save boundary.

pub fn revalidate_and_resolve( &self, auth: &ConnectionAuth, ) -> Result<ResolvedPrincipal, DenyReason>

Recheck non-secret local evidence and resolve one newly accepted generation. OIDC changes require initialize because this stage never retains the bearer that could be reverified.

pub fn resolve_current( &self, auth: &ConnectionAuth, ) -> Result<ResolvedPrincipal, DenyReason>

Resolve an established binding against the accepted policy, rechecking its local credential evidence only when its stamped generation is no longer current.

At an unchanged generation that evidence cannot have been invalidated: the OIDC verifiers, the uid roster, and the daemon-uid trust posture change only through a new publication, and the caller checks expiry, the revalidation deadline, and pairing liveness on every operation. This is the rule the dispatcher’s gate applies, and it is what keeps an OIDC binding, whose bearer is never retained, usable until a publication changes the authorization inputs; a config save that leaves them unchanged does not move the generation. After such a change, Self::revalidate_and_resolve applies and an OIDC binding must initialize again.

pub fn credential_is_live( &self, auth: &ConnectionAuth, ) -> Result<(), AuthDenied>

Whether the credential behind auth is still live: not expired, not past its revalidation deadline, and, for a native pairing token, still paired.

pub fn hold_authority(&self) -> AuthorityLease<'_>

Hold the accepted authorization state and the paired-token set still until the returned lease is dropped: no policy publication can install a new state and no pairing can be revoked meanwhile.

A surface that must not let a revocation land between its final authority check and the effect that check guards takes the lease, checks with AuthorityLease::current_grants, performs the effect, then drops it. A publication or revocation that arrives meanwhile completes after the effect, so the effect is ordered before it.

Keep the hold short and synchronous. While a publication or revocation is queued behind it, new readers of the same lock wait too, so do not reach this layer’s other methods on the holding thread; the lease answers from what it holds.

impl RpcInboundAuth

pub fn current_grants( &self, auth: &ConnectionAuth, ) -> Result<ResolvedGrants, AuthDenied>

The grants auth holds under the accepted policy in force now, not the ones stamped on it at admission: a live credential, a fresh resolution, and a generation that did not move underneath that resolution.

A surface that acts on an admitted binding after a wait calls this at the effect, so a revocation that lands during the wait binds it.

pub async fn authenticate( &self, transport: TransportKind, transport_credential: Credential, auth_token: Option<&str>, auth_provider: Option<&str>, ) -> Result<ConnectionAuth, AuthDenied>

Authenticate one initialize handshake into a ConnectionAuth.