Module auth 

authentication providers

Modules

api_key

API key authentication

axum

Axum middleware for HTTP authentication Axum middleware for HTTP authentication

client_ip

Client IP resolution (X-Forwarded-For / X-Real-IP / socket address), shared by every RequestParts construction site and by ip_allowlist’s allowlist check. Resolves the client IP address from request headers/extensions.

db_api_key

DB-backed API key authentication DB-backed API key authentication.

db_audience_grants

DB-backed audience grant store DB-backed audience grant store: a whole-table snapshot cache over the audience_grants table (migration v7, rust/ingestion/src/sql_migration.rs), checked alongside the static grant map by crate::policy::AudienceReadPolicy/crate::policy::AudienceMintPolicy – a selector present in either source grants access, without either side being deep-cloned or merged into a combined map (current() hands back the cached grants behind an Arc). This is what makes a grant creatable without a service restart – the static map stays the bootstrap/test-only layer.

db_snapshot

Generic whole-table snapshot cache shared by the audience-grant and group stores Generic whole-table snapshot cache, extracted from what used to be db_audience_grants.rs’s entire cache-mechanics implementation. crate::db_snapshot::SnapshotLoader is the one thing each store (audience grants, groups) supplies: how to fetch a fresh snapshot and which metric/name to report on a refresh failure. crate::db_snapshot::SnapshotSource is everything else – cold-start throttling, last-good serving after the first success, ProviderUnavailable wrapping – copied unchanged from the original DbAudienceGrantsSource.

default_provider

Default authentication provider initialization Default authentication provider initialization for Micromegas services.

env

Shared prefixed-env-var resolution ({prefix}_{suffix} with MICROMEGAS_{suffix} fallback) Shared prefixed-env-var resolution, used by every {prefix}_*-with-fallback knob in this crate ({prefix}_OIDC_CONFIG, {prefix}_DEFAULT_AUDIENCE), and the three surviving {prefix}_API_KEY_*CACHE* knobs ({prefix}_API_KEY_CACHE_SIZE, {prefix}_API_KEY_UNKNOWN_CACHE_TTL_SECONDS, {prefix}_API_KEY_UNKNOWN_CACHE_SIZE).

groups

Local group membership: GroupGraph, the DB-backed store, and closure resolution Local group membership: the groups/group_members tables (migration v10, rust/ingestion/src/sql_migration.rs), a whole-table snapshot cache (crate::groups::DbGroupsSource) mirroring crate::db_audience_grants::DbAudienceGrantsSource, and crate::groups::GroupGraph, the in-memory closure resolver over a loaded snapshot.

ip_allowlist

A typed, CIDR-based IP allowlist – the decision point ApiKeyAuthProvider and DbApiKeyAuthProvider both call to enforce a per-key source-IP restriction. A typed, allowlist-only IP allowlist: a set of CIDR ranges (or bare IPs, treated as a /32 or /128) a credential may be presented from. An empty allowlist means “no restriction” – the backward-compatible default for every key minted before this feature existed.

membership

Wraps an AuthProvider to resolve transitive local-group membership per request Wraps an inner crate::types::AuthProvider and resolves the caller’s transitive local-group membership once per request – the one resolution site upstream of every consumer (is_admin(), caller_selectors/selector_matches’s group: arm).

multi

Multi-provider authentication (API key + OIDC) Multi-provider authentication that tries multiple auth methods in sequence.

oauth_state

OAuth state parameter signing and verification OAuth state parameter signing and verification

oidc

OIDC authentication with JWKS caching

oidc_client

Canonical login-flow OIDC client construction (discovery + client building) Canonical login-flow OIDC client construction.

policy

Authorization seam: MintPolicy, ReadPolicy, and their audience-based implementations Authorization seam: MintPolicy, ReadPolicy, and the audience-based implementations that resolve them from a caller’s AuthContext and a static grant map keyed by audience name.

tower

Tower service layer for tonic/gRPC authentication Tower service layer for async authentication with tonic/gRPC.

types

Core authentication types and traits

url_validation

URL validation utilities for authentication flows URL validation utilities for authentication flows

user_attribution

User attribution validation (prevents impersonation attacks) User attribution validation for preventing impersonation attacks