Module middleware 

Dual-mode bearer/JWT/cookie auth middleware shipped as a [tower::Layer].

Consumers integrate with .layer(AuthLayer::new(...)) rather than wrapping a free authenticate_request function in a closure-of-7-args. The middleware writes an AuthContext into request extensions on success, returns an AuthError-shaped 401 response on failure, and (for cookie mode + browser GETs) optionally redirects to a configured login path so the configured OAuth/OIDC flow can establish a session.

Precedence (matches the legacy lab middleware):

1. Authorization: Bearer <token> matches the static bearer (constant-time compare) -> grants static_token_scopes.
2. Authorization: Bearer <token> validates as a JWT issued by the local auth state (audience + issuer enforced inside crate::jwt::SigningKeys::validate_access_token_with_issuer) -> grants the JWT-claim scopes.
3. (Optional, when AuthLayer was constructed with allow_session_cookie = true.) Browser session cookie matches a row in the auth store, with CSRF enforced for non-GET/HEAD/OPTIONS.
4. Otherwise, browser GET requests with Accept: text/html are redirected to the configured login path; everything else returns 401 with WWW-Authenticate: Bearer resource_metadata=....

Structs

AuthLayer

Tower layer that authenticates inbound requests and writes AuthContext into request extensions.

AuthService

Service half of AuthLayer. Forwards to inner after a successful authentication; otherwise short-circuits with a 401 / redirect response.

Functions

parse_bearer_token

Parse a single Authorization: Bearer <token> header value, returning None for malformed or non-Bearer schemes.

tokens_equal

Constant-time byte comparison for static-bearer matching (prevents timing-based prefix leakage).

Type Aliases

ActorKeyDeriver

Closure-erased actor-key derivation hook.