Struct AuthConfig 

pub struct AuthConfig {

    pub mode: AuthMode,
    pub public_url: Option<Url>,
    pub sqlite_path: PathBuf,
    pub key_path: PathBuf,
    pub bootstrap_secret: Option<String>,
    pub allowed_client_redirect_uris: Vec<String>,
    pub admin_email: String,
    pub google: GoogleConfig,
    pub authelia: AutheliaConfig,
    pub github: GitHubConfig,
    pub default_provider: String,
    pub access_token_ttl: Duration,
    pub refresh_token_ttl: Duration,
    pub auth_code_ttl: Duration,
    pub register_requests_per_minute: u32,
    pub authorize_requests_per_minute: u32,
    pub max_pending_oauth_states: usize,
    pub env_prefix: String,
    pub default_data_dir: PathBuf,
    pub session_cookie_name: String,
    pub scopes_supported: Vec<String>,
    pub resource_path: String,
    pub default_scope: String,
    pub static_token_scopes: Vec<String>,
    pub login_path: String,
    pub enable_dynamic_registration: bool,
    pub disable_static_token_with_oauth: bool,
    pub token_encryption_key: Option<TokenEncryptionKey>,
}

Fields

mode: AuthMode

public_url: Option<Url>

sqlite_path: PathBuf

key_path: PathBuf

bootstrap_secret: Option<String>

allowed_client_redirect_uris: Vec<String>

admin_email: String

Single bootstrap admin email permitted to log in through any configured OAuth/OIDC provider. Required when mode == AuthMode::OAuth. Additional users are granted through the SQLite-backed allowlist managed via the web UI.

google: GoogleConfig

authelia: AutheliaConfig

github: GitHubConfig

default_provider: String

Which configured provider /authorize and /auth/login use when the request omits ?provider=. Must name a provider that is actually configured (validated in AuthConfig::validate). Resolved automatically when unset: google > authelia > github, in that priority order, picking the first one that has credentials — this is what makes every existing single-provider (Google-only) deployment keep working with zero config changes after upgrading.

access_token_ttl: Duration

refresh_token_ttl: Duration

auth_code_ttl: Duration

register_requests_per_minute: u32

authorize_requests_per_minute: u32

max_pending_oauth_states: usize

env_prefix: String

Env var prefix used for diagnostics (e.g. "LAB", "SYSLOG_MCP"). Set via AuthConfigBuilder::env_prefix BEFORE any env reads.

default_data_dir: PathBuf

Default base directory for auth.db and auth-jwt.pem when the corresponding env vars are unset.

session_cookie_name: String

Browser session cookie name. Lab consumer leaves this at the default ("lab_session"); other consumers override with their own brand.

scopes_supported: Vec<String>

Scopes advertised on /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource.

resource_path: String

Path appended to public_url to form the canonical resource URL returned in the protected-resource metadata document.

default_scope: String

Default scope applied when /authorize requests omit one and the only scope accepted by the legacy single-scope validator.

static_token_scopes: Vec<String>

Scopes minted into the static-bearer-derived AuthContext so legacy admin tools keep functioning when the dual-mode middleware (L2) is deployed. Lab keeps the legacy ["lab:read","lab:admin"] defaults; cortex will override with ["syslog:read","syslog:admin"].

login_path: String

Path of the browser login route (typically /auth/login).

enable_dynamic_registration: bool

Whether POST /register (RFC 7591 dynamic client registration) is mounted. Defaults to false (closed) — opt-in per consumer.

disable_static_token_with_oauth: bool

When true, dual-mode middleware MUST reject the static bearer token whenever OAuth is active. Defaults to false (lab keeps the historical break-glass behavior); cortex overrides to true.

token_encryption_key: Option<TokenEncryptionKey>

Optional at-rest encryption key for upstream provider refresh tokens.

When present, provider refresh tokens are encrypted with ChaCha20-Poly1305 before being written to SQLite. Set via {PREFIX}_TOKEN_ENCRYPTION_KEY (64 hex digits or 43 base64url chars). When absent, tokens are stored as plaintext (backward-compatible).

Implementations

impl AuthConfig

pub fn from_sources( vars: impl IntoIterator<Item = (String, String)>, ) -> Result<Self, AuthError>

Backward-compatible convenience: read env vars using the default LAB prefix. Equivalent to AuthConfigBuilder::new().build_from_sources(vars).

Trait Implementations

impl Clone for AuthConfig

fn clone(&self) -> AuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthConfig

fn default() -> Self

Returns the “default value” for a type.

impl PartialEq for AuthConfig

fn eq(&self, other: &AuthConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for AuthConfig

impl StructuralPartialEq for AuthConfig