Enum AuthContext 

pub enum AuthContext {
    Disabled,
    Scoped(ScopedContext),
    Preauthorized,
}

AuthContext encapsulates the verified authorization details of a request.

AuthContext::assert_authorized can be used to check whether a request is authorized to perform certain operations on a given resource.

Variants

Disabled

Authorization is inactive; every operation is permitted.

Scoped(ScopedContext)

A verified JWT; each operation is checked against these scopes and permissions.

Preauthorized

A valid signature already authorized this exact request.

Implementations

impl AuthContext

pub fn from_encoded_jwt( encoded_token: Option<&str>, key_directory: &PublicKeyDirectory, ) -> Result<AuthContext, AuthError>

Construct an AuthContext from an encoded JWT.

Objectstore JWTs must contain:

• the kid header indicating which key was used to sign the token
• the exp claim indicating when the token expires

The aud claim is not required, but if set it must be "objectstore". The iss claim is not required, but if set it must be "relay" or "sentry".

To verify the token, objectstore will look up a list of possible keys based on the kid header field and attempt verification. It will also ensure that the timestamp from the exp claim field has not passed.

pub fn from_presigned_request( method: &Method, path: &str, raw_query: Option<&str>, params: &PresignParams, key_directory: &PublicKeyDirectory, now: SystemTime, ) -> Result<AuthContext, AuthError>

Construct an AuthContext from a pre-signed request.

A pre-signed URL carries its signature and parameters in the query string (see [objectstore_types::presign]). This verifies the signature against the request’s canonical form and enforces the maximum duration, returning AuthContext::Preauthorized on success.

pub fn assert_authorized( &self, perm: Permission, context: &ObjectContext, ) -> Result<(), AuthError>

Ensures that an operation requiring perm and applying to path is authorized. If not, Err(AuthError::NotPermitted) is returned.

• AuthContext::Disabled permits every operation.
• AuthContext::Scoped permits the operation if perm is within the granted permissions and usecase and scopes match the granted ones.
• AuthContext::Preauthorized always permits the operation — the signing key’s permissions were already verified when the pre-signed URL was validated.

Trait Implementations

impl Debug for AuthContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for AuthContext

fn eq(&self, other: &AuthContext) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AuthContext