mars-server · middleware

Package: mars-server · Workspace version: 0.1.0 · Module: middleware

This reference follows declared modules and public syntax, including public implementation methods. Function bodies and constant values are omitted. Feature conditions are retained. Private-module re-exports and trait resolution require the compiler; not every declaration is a root import.

middleware::auth

Middleware for the MARS registry server.

Currently provides:

A bounded token-bucket [RateLimiter] keyed by fixed-size client hashes.
Trusted-proxy-aware transport identity and route admission middleware.
[auth::require_capability] — provider-neutral session and capability authorization for mutation endpoints.

pub mod auth;

Source line: 9.

middleware::RateLimiter

Token-bucket rate limiter.

Each client key maps to a bucket containing a remaining token count and the last refill timestamp. When a request arrives, the bucket is refilled based on elapsed time, then one token is consumed. If no tokens remain the request is rejected. The bucket map is hard-capped, stale buckets expire, and new keys evict the least-recently-seen bucket with a lexical hashed-key tie-breaker. This keeps memory bounded and makes eviction deterministic across replicas receiving the same request order.

pub struct RateLimiter {

}

Source line: 55.

middleware::RateLimiter::new

Create a new rate limiter.

max_per_minute sets both the bucket capacity and defines the refill interval as 60 seconds (one minute).

pub fn new(max_per_minute: u32) -> Self;

Source line: 68.

middleware::RateLimiter::with_policy

Create a limiter with explicit, validated memory bounds.

pub fn with_policy(
        max_per_minute: u32,
        max_buckets: usize,
        bucket_ttl: Duration,
    ) -> Result<Self, ServerError>;

Source line: 78.

middleware::RateLimiter::check

Check if a request from client_key is allowed.

Returns true if the request should proceed, false if rate-limited. Calling this method consumes one token from the client's bucket.

pub fn check(&self, client_key: &str) -> bool;

Source line: 105.

middleware::ClientIdentity

Stable, privacy-minimal identity used only for in-process admission policy.

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct ClientIdentity(Arc<str>);

Source line: 191.

middleware::ClientIdentity::as_key

Canonical rate-limit key.

pub fn as_key(&self) -> &str;

Source line: 203.

middleware::ClientIdentity::audit_actor

Pseudonymous actor identifier for pre-authentication audit records.

pub fn audit_actor(&self) -> String;

Source line: 208.

middleware::ClientIdentityResolver

Resolve a client from the direct transport peer and explicitly trusted proxy networks. Forwarding headers are ignored unless the direct peer is in one of the configured CIDRs.

#[derive(Debug, Clone)]
pub struct ClientIdentityResolver {

}

Source line: 219.

middleware::ClientIdentityResolver::new

pub fn new(trusted_proxies: Vec<IpNet>) -> Self;

Source line: 224.

middleware::ClientIdentityResolver::resolve

pub fn resolve(&self, headers: &HeaderMap, direct_peer: Option<SocketAddr>) -> ClientIdentity;

Source line: 230.

middleware::attach_client_identity

Attach one trusted client identity before admission middleware executes.

pub async fn attach_client_identity(
    State(resolver): State<ClientIdentityResolver>,
    mut request: Request,
    next: Next,
) -> Response;

Source line: 367.

middleware::RateLimitRequirement

Route-level rate-limit policy.

#[derive(Clone)]
pub struct RateLimitRequirement {

}

Source line: 383.

middleware::RateLimitRequirement::new

pub fn new(app: Arc<AppState>, bucket: RateLimitBucket) -> Self;

Source line: 389.

middleware::enforce_rate_limit

Enforce a route's per-client admission limit.

pub async fn enforce_rate_limit(
    State(requirement): State<RateLimitRequirement>,
    request: Request,
    next: Next,
) -> Response;

Source line: 395.

Source provenance

Source: mars-server/src/middleware/mod.rs · SHA-256 732e7b9b7e17859558d5273773a27ae777c1a1b668afbaaff91801af53d1e425. Package overview.

mars-server · middleware

On this page