Struct AuthState 

pub struct AuthState {
    pub config: Arc<AuthConfig>,
    pub store: SqliteStore,
    pub signing_keys: Arc<SigningKeys>,
    pub providers: Arc<BTreeMap<String, Arc<dyn OAuthProvider>>>,
    pub default_provider: String,
    /* private fields */
}

Fields

config: Arc<AuthConfig>

store: SqliteStore

signing_keys: Arc<SigningKeys>

providers: Arc<BTreeMap<String, Arc<dyn OAuthProvider>>>

default_provider: String

Implementations

impl AuthState

pub async fn new(config: AuthConfig) -> Result<Self, AuthError>

pub fn set_allowed_resource_urls( &self, resources: impl IntoIterator<Item = String>, )

Replace the extra OAuth resource audiences accepted by /authorize and /token.

The canonical {LAB_PUBLIC_URL}/mcp resource is always accepted; callers use this to publish Gateway-managed protected MCP resources such as https://mcp.example.com/syslog or https://syslog.example.com/mcp.

pub fn set_allowed_resource_scopes( &self, resources: impl IntoIterator<Item = (String, Vec<String>)>, )

Replace the extra OAuth resource audiences and the scopes each resource accepts.

pub fn is_allowed_resource_url(&self, resource: &str) -> bool

pub fn allowed_resource_scopes(&self, resource: &str) -> Option<Vec<String>>

pub async fn check_authorize_rate_limit( &self, ip: IpAddr, ) -> Result<(), AuthError>

Rate-limit guard for /authorize and /browser_login endpoints.

Keyed per remote IP so one client cannot exhaust the global bucket (lab-77y5.10). Uses tokio::sync::Mutex internally so contention does not park a Tokio worker thread (lab-77y5.9).

pub async fn check_register_rate_limit( &self, ip: IpAddr, ) -> Result<(), AuthError>

Rate-limit guard for /register endpoint.

Keyed per remote IP — see check_authorize_rate_limit for the rationale.

pub async fn resolve_allowed_emails(&self) -> Result<Vec<String>, AuthError>

Returns the merged email allowlist: admin first, then all allowed_users rows, deduplicating case-insensitively so admin is never counted twice.

This is the single source of truth used in both OAuth callback branches. A DB error is surfaced as AuthError::Storage (fail-closed — server fault, not user fault).

Never log the returned emails directly — pass them only to check_email_allowlist, which uses fingerprint() for safe diagnostics.

pub async fn ensure_pending_oauth_state_capacity(&self) -> Result<(), AuthError>

Rejects new OAuth state rows when the pending count exceeds max_pending_oauth_states.

pub fn provider(&self, id: &str) -> Result<Arc<dyn OAuthProvider>, AuthError>

Look up a specific configured provider by id. Returns AuthError::Validation if id does not name a configured provider — this is a request-shaped error (bad ?provider= query param, or a stale DB row naming a provider that has since been unconfigured), not a server fault.

pub fn provider_or_default( &self, id: Option<&str>, ) -> Result<Arc<dyn OAuthProvider>, AuthError>

Self::provider, falling back to Self::default_provider when id is None.

Trait Implementations

impl Clone for AuthState

fn clone(&self) -> AuthState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.