Trait AuthProvider 

pub trait AuthProvider: Send + Sync {
    // Required methods
    fn name(&self) -> &str;
    fn method(&self) -> AuthMethod;
    fn accepts(&self, credential: &Credential) -> bool;
    fn verify<'life0, 'life1, 'async_trait>(
        &'life0 self,
        credential: &'life1 Credential,
    ) -> Pin<Box<dyn Future<Output = AuthOutcome> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait;
}

An RFC authentication provider: verifies one credential kind and emits a uniform AuthOutcome. Implementations live beside their identity source (e.g. oidc next to the IdP introspection code, native over PairingGuard).

Fail-closed contract: verify returns AuthOutcome::Denied for anything it cannot positively authenticate — never a silent allow.

Required Methods

fn name(&self) -> &str

Stable provider name = its config key (e.g. "oidc", "native", "ssh-key"). Used for enumeration and diagnostics.

fn method(&self) -> AuthMethod

The AuthMethod this provider attests on success (also what it advertises in the handshake).

fn accepts(&self, credential: &Credential) -> bool

Whether this provider can attempt the given credential kind. Lets the registry skip providers that don’t apply without burning a verify.

fn verify<'life0, 'life1, 'async_trait>( &'life0 self, credential: &'life1 Credential, ) -> Pin<Box<dyn Future<Output = AuthOutcome> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Verify the credential and resolve grants. Fail-closed.

Implementors