Module auth 

Bearer-token authentication for the MCP endpoint.

Separate from the Admin API’s Basic Auth on purpose: an agent gets a narrower credential (read or write) that is useless on /api/*, and the Admin credentials are useless here. The token is resolved on every request (never cached on the MCP session) so a client cannot keep a scope it no longer presents.

Structs

McpAuthState

Configured tokens, ready for constant-time lookup.

McpPrincipal

The identity behind an authenticated MCP request.

Enums

AuthFailure

Why a request was refused. Deliberately coarse: callers must not leak whether a token was unknown, malformed, or absent.

Functions

authenticate

authenticate_for with the authority taken from the Host header.

authenticate_for

Resolves the principal for a request from its headers, taking the request authority (Host, or the HTTP/2 :authority) from authority.

bearer_middleware

axum middleware for the MCP path: authenticates, then stores the McpPrincipal in request extensions for the server handler to read.

origin_authority 🔒

Extracts host[:port] from an Origin value such as https://a.b:9091.