Struct AuthContext 

#[non_exhaustive]
pub struct AuthContext {
    pub usecase: String,
    pub scopes: BTreeMap<String, StringOrWildcard>,
    pub permissions: HashSet<Permission>,
}

AuthContext encapsulates the verified content of things like authorization tokens.

AuthContext::assert_authorized can be used to check whether a request is authorized to perform certain operations on a given resource.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

usecase: String

The objectstore usecase that this request may act on.

See also: [ObjectContext::usecase].

scopes: BTreeMap<String, StringOrWildcard>

The scope elements that this request may act on.

See also: [ObjectContext::scopes].

permissions: HashSet<Permission>

The permissions that this request has been granted.

Implementations

impl AuthContext

pub fn from_encoded_jwt( encoded_token: Option<&str>, key_directory: &PublicKeyDirectory, ) -> Result<AuthContext, AuthError>

Construct an AuthContext from an encoded JWT.

Objectstore JWTs must contain:

• the kid header indicating which key was used to sign the token
• the exp claim indicating when the token expires

The aud claim is not required, but if set it must be "objectstore". The iss claim is not required, but if set it must be "relay" or "sentry".

To verify the token, objectstore will look up a list of possible keys based on the kid header field and attempt verification. It will also ensure that the timestamp from the exp claim field has not passed.

pub fn assert_authorized( &self, perm: Permission, context: &ObjectContext, ) -> Result<(), AuthError>

Ensures that an operation requiring perm and applying to path is authorized. If not, Err(AuthError::NotPermitted) is returned.

The passed-in perm is checked against this AuthContext’s permissions. If it is not present, then the operation is not authorized.

Trait Implementations

impl Debug for AuthContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for AuthContext

fn eq(&self, other: &AuthContext) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AuthContext