zeroclaw_runtime::security::auth_provider

Trait AuthProvider

pub trait AuthProvider: Send + Sync {
    // Required methods
    fn name(&self) -> &str;
    fn method(&self) -> AuthMethod;
    fn accepts(&self, credential: &Credential) -> bool;
    fn verify<'life0, 'life1, 'async_trait>(
        &'life0 self,
        credential: &'life1 Credential,
    ) -> Pin<Box<dyn Future<Output = AuthOutcome> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait;
}

Expand description

An RFC authentication provider: verifies one credential kind and emits a uniform AuthOutcome. Implementations live beside their identity source (e.g. oidc next to the token-verification code, native over PairingGuard).

Fail-closed contract: verify returns AuthOutcome::Denied for anything it cannot positively authenticate — never a silent allow. Providers verify credentials into identities; they never resolve or attach grants.

Required Methods§

Source

fn name(&self) -> &str

Stable provider name = its config selection key (e.g. "native", "peercred", "oidc.corp" for [oidc.corp]). Unique within a registry; the handshake selects a provider by this name.

Source

fn method(&self) -> AuthMethod

The AuthMethod this provider attests on success (also what it advertises in the handshake).

Source

fn accepts(&self, credential: &Credential) -> bool

Whether this provider can attempt the given credential kind. Used to reject a mis-kinded credential before verify, and to route transport-intrinsic credentials — never to try one credential across providers.

Source