Struct AuthContext 

pub struct AuthContext {
    pub subject: String,
    pub email: Option<String>,
    pub issuer: String,
    pub audience: Option<String>,
    pub expires_at: Option<DateTime<Utc>>,
    pub auth_type: AuthType,
    pub allow_delegation: bool,
    pub bound_audience: Option<String>,
    pub read_audiences: Vec<String>,
    pub memberships: Arc<[String]>,
}

Authentication context containing user identity and metadata

Fields

subject: String

Unique subject identifier (e.g., user ID, service account ID)

email: Option<String>

Email address (if available)

issuer: String

Issuer (for OIDC) or “api_key” for API key auth

audience: Option<String>

Audience that was matched during token validation

• For OIDC access tokens: API audience (e.g., “https://api.example.com”)
• For OIDC ID tokens: client ID
• For API key auth: None

expires_at: Option<DateTime<Utc>>

Token expiration time (if applicable)

auth_type: AuthType

Authentication type

allow_delegation: bool

Whether this authentication allows user delegation (acting on behalf of others)

• OIDC user tokens: false (user cannot impersonate others)
• Analytics API keys/service accounts: true (can act on behalf of users)
• Ingestion API keys: false — a write credential is not a delegating service account, and it can never reach the gRPC path this flag governs anyway (ingestion_api_keys never crosses flight_sql_service_impl.rs)

bound_audience: Option<String>

The write audience an ingestion key is immutably bound to. Some(..) for every ingestion API key (the ingestion_api_keys.audience column is NOT NULL as of migration v6); None for every other principal kind. Write-side only; never consulted by ReadPolicy.

read_audiences: Vec<String>

The set of audiences an analytics service-account key is granted read access to. Empty for every principal today — no analytics key provider populates it yet. Read-side only; folded into AudienceReadPolicy::resolve’s union but never into AudienceMintPolicy’s mintable set (a read grant confers no mint authority).

memberships: Arc<[String]>

The caller’s resolved, transitive local-group membership – filled by crate::membership::MembershipProvider from a crate::groups::GroupGraph snapshot, after the inner provider authenticates the request. Empty until a MembershipProvider fills it (disabled-auth and maintenance contexts set this to Arc::from([ADMINS_GROUP.to_string()]) directly instead). AudienceReadPolicy/ AudienceMintPolicy match each entry against group:<name> grant-map selectors via crate::policy::caller_selectors/selector_matches.

Implementations

impl AuthContext

pub fn is_admin(&self) -> bool

true iff memberships contains ADMINS_GROUP – a method, not a field, so no construction site can set it inconsistently with memberships.

Trait Implementations

impl Clone for AuthContext

fn clone(&self) -> AuthContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.