Struct ProviderRegistry 

pub struct ProviderRegistry { /* private fields */ }

The configured set of providers, consulted in order. Default-deny: if no provider accepts-and-authenticates the credential, the outcome is AuthOutcome::Denied. An empty registry rejects everything.

Implementations

impl ProviderRegistry

pub fn new() -> Self

pub fn register(&mut self, provider: Arc<dyn AuthProvider>)

Register a provider (boot-time wiring).

pub fn is_empty(&self) -> bool

true if no provider is configured (default-deny will reject all).

pub fn advertised_methods(&self) -> Vec<AuthMethod>

The methods this registry advertises (for the handshake authMethods).

pub fn names(&self) -> Vec<&str>

The configured provider names, in registration order — the enumeration surface exposes over RPC (no hardcoded provider lists).

pub async fn resolve(&self, credential: &Credential) -> AuthOutcome

Resolve a presented credential to an AuthOutcome, default-deny and authoritative-deny.

The first accepting provider that authenticates wins. The key safety rule: a provider that accepts a credential but rejects it with a specific DenyReason (anything other than the generic DenyReason::BadCredential — e.g. DenyReason::MfaRequired, DenyReason::TokenExpired, DenyReason::Misconfigured, DenyReason::AliasNotEntitled) is authoritative: that outcome is returned immediately so a later, more broadly-accepting provider can NOT authenticate the same presented credential past it (e.g. an OIDC provider returning MfaRequired for a bearer token can’t be bypassed by a later catch-all bearer provider). Only the generic BadCredential (“not my credential / wrong secret”) lets the registry fall through to the next accepting provider. None is denied before any provider runs. An empty registry denies everything.

Trait Implementations

impl Default for ProviderRegistry

fn default() -> ProviderRegistry

Returns the “default value” for a type.