mars-server · auth::principal

Package: mars-server · Workspace version: 0.1.0 · Module: auth::principal

This reference follows declared modules and public syntax, including public implementation methods. Function bodies and constant values are omitted. Feature conditions are retained. Private-module re-exports and trait resolution require the compiler; not every declaration is a root import.

auth::principal::AuthProfile

Stable identifier for an authentication profile registered with MARS.

The string-backed representation is deliberate: OpenAgent, Arsenal, and future profiles can be registered without expanding a closed provider enum in the always-on authentication domain.

#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
#[serde(transparent)]
pub struct AuthProfile(String);

Source line: 21.

auth::principal::AuthProfile::SIWS

Concrete Sign-In-With-Sigil profile implemented by this release.

pub const SIWS: &'static str;

Source line: 25.

auth::principal::AuthProfile::OPEN_AGENT

Reserved profile name for a future OpenAgent adapter.

pub const OPEN_AGENT: &'static str;

Source line: 27.

auth::principal::AuthProfile::ARSENAL

Reserved profile name for a future Arsenal adapter.

pub const ARSENAL: &'static str;

Source line: 29.

auth::principal::AuthProfile::FEDERATION

MARS-owned signed registry federation profile.

pub const FEDERATION: &'static str;

Source line: 31.

auth::principal::AuthProfile::parse

Construct a profile identifier after validating its stable wire form.

pub fn parse(value: impl Into<String>) -> Result<Self, AuthError>;

Source line: 34.

auth::principal::AuthProfile::siws

Sign-In-With-Sigil profile identifier.

pub fn siws() -> Self;

Source line: 47.

auth::principal::AuthProfile::open_agent

OpenAgent extension profile identifier.

pub fn open_agent() -> Self;

Source line: 52.

auth::principal::AuthProfile::arsenal

Arsenal extension profile identifier.

pub fn arsenal() -> Self;

Source line: 57.

auth::principal::AuthProfile::federation

Signed MARS registry federation profile.

pub fn federation() -> Self;

Source line: 62.

auth::principal::AuthProfile::as_str

Borrow the stable profile identifier.

pub fn as_str(&self) -> &str;

Source line: 67.

auth::principal::Capability

MARS authorization capabilities granted to an authenticated principal.

#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum Capability {
    PublishEntry,
    UpdateEntry,
    RevokeEntry,
    TransferOut,
    TransferAccept,
    Attest,
    Report,
    FederatedDiscovery,
    FederationSync,
    Admin,
}

Source line: 89.

auth::principal::Capability::as_str

Stable database and diagnostic representation.

pub fn as_str(self) -> &'static str;

Source line: 104.

auth::principal::CapabilitySet

Closed, deterministic capability collection.

#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(transparent)]
pub struct CapabilitySet(BTreeSet<Capability>);

Source line: 151.

auth::principal::CapabilitySet::new

Empty capability set.

pub fn new() -> Self;

Source line: 155.

auth::principal::CapabilitySet::entry_publisher

Capabilities granted to a normal entry publisher.

pub fn entry_publisher() -> Self;

Source line: 160.

auth::principal::CapabilitySet::contains

Whether the set grants capability.

pub fn contains(&self, capability: Capability) -> bool;

Source line: 174.

auth::principal::CapabilitySet::iter

Iterate in stable capability order.

pub fn iter(&self) -> impl Iterator<Item = Capability> + '_;

Source line: 179.

auth::principal::Principal

Provider-neutral authenticated request principal.

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct Principal {
/// Durable session identifier used for audit correlation.

pub session_id: uuid::Uuid,
/// DID that presented and proved the credential.

pub subject_did: String,
/// DID permitted to author publisher-bound MARS entries.

pub publisher_did: String,
/// Root authority DID established by the adapter.

pub authorization_root_did: String,
/// Adapter-defined root classification retained for profile responses.

pub authorization_root_kind: String,
/// Authentication profile that established this principal.

pub profile: AuthProfile,
/// Explicit authorization capabilities.

pub capabilities: CapabilitySet,
/// Session issue time in server-controlled Unix milliseconds.

pub issued_at_ms: i64,
/// Session expiry in server-controlled Unix milliseconds.

pub expires_at_ms: i64
}

Source line: 199.

auth::principal::Principal::is_active_at

Whether this principal is still active at now_ms.

pub fn is_active_at(&self, now_ms: i64) -> bool;

Source line: 222.

auth::principal::Principal::require

Require a capability without consulting any provider-specific state.

pub fn require(&self, capability: Capability) -> Result<(), AuthError>;

Source line: 227.

auth::principal::Credential

Provider credential envelope accepted by the adapter registry.

#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct Credential {
pub scheme: String,
pub payload: serde_json::Value
}

Source line: 242.

auth::principal::Credential::new

pub fn new(scheme: impl Into<String>, payload: serde_json::Value) -> Self;

Source line: 248.

auth::principal::AuthError

Fail-closed authentication-domain errors.

#[derive(Debug, thiserror::Error)]
pub enum AuthError {
    #[error("authentication scheme `{scheme}` is not registered")]
    UnknownScheme { scheme: String },
    #[error("authentication profile `{profile}` is not enabled")]
    ProfileDisabled { profile: AuthProfile },
    #[error("invalid authentication profile `{profile}`")]
    InvalidProfile { profile: String },
    #[error("invalid capability `{capability}`")]
    InvalidCapability { capability: String },
    #[error("authentication credential rejected: {0}")]
    CredentialRejected(String),
    #[error("authentication dependency failed: {0}")]
    Dependency(String),
    #[error("authentication storage failed: {0}")]
    Storage(String),
    #[error("authentication registry configuration is invalid: {0}")]
    Registry(String),
    #[error("principal `{subject_did}` lacks capability `{capability}`")]
    MissingCapability {
        capability: Capability,
        subject_did: String,
    },
}

Source line: 258.

Source provenance

Source: mars-server/src/auth/principal.rs · SHA-256 9f5ba899eab83b43804784be40f717776f24adb68e86366ccc62c37c66e98207. Package overview.

mars-server · auth::principal

On this page