Module auth_provider 

RFC 7141 inbound authentication seam: the AuthProvider trait + a default-deny ProviderRegistry with EXPLICIT provider selection.

Each provider verifies ONE credential kind (OIDC token, peer uid, native pairing bearer, …) and emits a uniform zeroclaw_api::principal::AuthenticatedIdentity — identity and evidence only. Grants are resolved separately by the shared principal resolver from the current permission-profile configuration, so providers cannot carry an authorization vocabulary and cannot snapshot policy.

Credential routing is explicit and unambiguous (Rev 8): the handshake names the intended provider (ProviderRegistry::resolve_named) unless the credential format securely identifies it (ProviderRegistry::route_transport for kernel-supplied peer credentials). A credential is never offered to every configured provider, and once a provider was selected its denial is authoritative — there is no fallback to another provider or to broader authority.

NOTE — name distinction: this AuthProvider (an inbound auth trait) is unrelated to zeroclaw_providers::auth’s AuthProvider enum, which names outbound LLM-provider OAuth kinds. They live in different crates and never coexist in one import scope.

This module is the foundational seam: it has no production call sites yet (the registry is empty until providers are constructed at gateway/RPC boot in a later phase), so it changes no runtime behaviour. Default-deny means an empty registry rejects everything — wiring it on is a deliberate, later step.

Re-exports

pub use enrollment::DeviceGrantStart;

pub use enrollment::DevicePollOutcome;

pub use enrollment::EnrolledToken;

pub use enrollment::Enrollment;

pub use enrollment::LoopbackListener;

pub use enrollment::PkceFlow;

pub use native::NativeAuthProvider;

pub use oidc::OidcAuthProvider;

pub use peercred::PeercredAuthProvider;

pub use peercred::UidRoster;

Modules

enrollment

Browserless OIDC enrollment: obtain an access token to present as auth_token in the RPC handshake.

native

The native provider: authenticates the existing gateway pairing bearer token as the shared operator, over the ONE live pairing authority.

oidc

The oidc.<alias> auth provider: verifies a presented bearer token against ONE configured issuer — offline (JWKS signature validation) or online (RFC 7662 introspection) — and emits the verified AuthenticatedIdentity for the shared principal resolver.

peercred

The peercred provider: authenticates a local-socket peer by its kernel-reported uid.

Structs

ProviderRegistry

The configured set of providers, selected by name. Default-deny: an empty registry rejects everything, an unknown selection rejects, a mis-kinded credential rejects, and a selected provider’s denial is final.

Enums

Credential

A credential presented for verification (the input to the initialize handshake). Secret material is redacted in Debug — never log it raw.

Traits

AuthProvider

An RFC authentication provider: verifies one credential kind and emits a uniform AuthOutcome. Implementations live beside their identity source (e.g. oidc next to the token-verification code, native over PairingGuard).