Struct Principal 

#[non_exhaustive]
pub struct Principal {
    pub id: PrincipalId,
    pub user_id: String,
    pub roles: Vec<String>,
    pub scopes: Vec<String>,
    pub auth_method: AuthMethod,
    pub mfa_verified: bool,
    pub expires_at: u64,
    pub allowed_aliases: Vec<AgentAlias>,
}

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

id: PrincipalId

user_id: String

Human/account identifier from the identity source (e.g. OIDC sub). Equals id.0 for a real user; sentinel for AuthMethod::SharedOperator.

roles: Vec<String>

Coarse roles the identity source asserted (drives IamPolicy mapping).

scopes: Vec<String>

Fine-grained scopes/capabilities granted this session.

auth_method: AuthMethod

How this principal authenticated.

mfa_verified: bool

Whether a second factor was completed (drives any step-up policy).

expires_at: u64

Session expiry, UNIX seconds; 0 = no expiry.

allowed_aliases: Vec<AgentAlias>

Agent aliases this principal MAY bind at session/new. Empty + no roles ⇒ the AuthMethod::SharedOperator fallback (“any configured alias”, today’s behaviour).

Implementations

impl Principal

pub fn shared_operator() -> Self

pub fn new( id: impl Into<PrincipalId>, user_id: impl Into<String>, auth_method: AuthMethod, ) -> Self

Construct an authenticated principal with the given subject id and method. Grants default to empty; attach claims via the with_* builder setters. This is the construction path other crates (the providers) must use because the struct is #[non_exhaustive].

pub fn with_roles(self, roles: Vec<String>) -> Self

Attach the role claims the identity source asserted.

pub fn with_scopes(self, scopes: Vec<String>) -> Self

Attach the scope claims granted this session.

pub fn with_mfa_verified(self, mfa_verified: bool) -> Self

Mark MFA as completed.

pub fn with_expires_at(self, expires_at: u64) -> Self

Set the session expiry (UNIX seconds; 0 = none).

pub fn with_allowed_aliases(self, allowed_aliases: Vec<AgentAlias>) -> Self

Attach the agent aliases this principal may bind.

pub fn is_authenticated(&self) -> bool

true once a distinct identity source authenticated this principal — i.e. not unbound (AuthMethod::None) and not the shared-operator sentinel. A2A distinct-principal routing keys on this.

Trait Implementations

impl Clone for Principal

fn clone(&self) -> Principal

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Principal

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Principal

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Principal

fn eq(&self, other: &Principal) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Principal

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for Principal

impl StructuralPartialEq for Principal