Struct AuthConfig 

pub struct AuthConfig {

    pub mode: AuthMode,
    pub public_url: Option<String>,
    pub google_client_id: Option<String>,
    pub google_client_secret: Option<String>,
    pub google_callback_path: Option<String>,
    pub google_scopes: Vec<String>,
    pub authelia_issuer_url: Option<String>,
    pub authelia_client_id: Option<String>,
    pub authelia_client_secret: Option<String>,
    pub authelia_callback_path: Option<String>,
    pub authelia_scopes: Vec<String>,
    pub github_client_id: Option<String>,
    pub github_client_secret: Option<String>,
    pub github_callback_path: Option<String>,
    pub github_scopes: Vec<String>,
    pub default_provider: Option<String>,
    pub admin_email: String,
    pub allowed_emails: Vec<String>,
    pub bootstrap_secret: Option<String>,
    pub sqlite_path: Option<String>,
    pub key_path: Option<String>,
    pub access_token_ttl_secs: Option<u64>,
    pub refresh_token_ttl_secs: Option<u64>,
    pub auth_code_ttl_secs: Option<u64>,
    pub register_rpm: Option<u32>,
    pub authorize_rpm: Option<u32>,
    pub max_pending_oauth_states: Option<usize>,
    pub allowed_client_redirect_uris: Vec<String>,
    pub token_encryption_key: Option<String>,
}

OAuth / JWT auth sub-config.

This struct types every env var soma_auth::AuthConfigBuilder consumes (SOMA_MCP_*). Fields left unset (None / empty) are deliberately NOT given soma-side defaults: soma_integrations::auth synthesizes a var list from set fields only, so the auth crate’s own defaults (see crates/shared/auth/src/config.rs) apply exactly as they would have when the builder read process env directly.

Fields

mode: AuthMode

public_url: Option<String>

Public base URL for OAuth metadata (SOMA_MCP_PUBLIC_URL).

google_client_id: Option<String>

Google OAuth client ID (SOMA_MCP_GOOGLE_CLIENT_ID).

google_client_secret: Option<String>

Google OAuth client secret (SOMA_MCP_GOOGLE_CLIENT_SECRET).

google_callback_path: Option<String>

Google OAuth callback path override (SOMA_MCP_GOOGLE_CALLBACK_PATH).

google_scopes: Vec<String>

Google OAuth scopes override (SOMA_MCP_GOOGLE_SCOPES, comma-separated in env).

authelia_issuer_url: Option<String>

Authelia OIDC issuer URL (SOMA_MCP_AUTHELIA_ISSUER_URL, must be https).

authelia_client_id: Option<String>

Authelia OIDC client ID (SOMA_MCP_AUTHELIA_CLIENT_ID).

authelia_client_secret: Option<String>

Authelia OIDC client secret (SOMA_MCP_AUTHELIA_CLIENT_SECRET).

authelia_callback_path: Option<String>

Authelia callback path override (SOMA_MCP_AUTHELIA_CALLBACK_PATH).

authelia_scopes: Vec<String>

Authelia scopes override (SOMA_MCP_AUTHELIA_SCOPES, comma-separated in env).

github_client_id: Option<String>

GitHub OAuth App client ID (SOMA_MCP_GITHUB_CLIENT_ID).

github_client_secret: Option<String>

GitHub OAuth App client secret (SOMA_MCP_GITHUB_CLIENT_SECRET).

github_callback_path: Option<String>

GitHub callback path override (SOMA_MCP_GITHUB_CALLBACK_PATH).

github_scopes: Vec<String>

GitHub scopes override (SOMA_MCP_GITHUB_SCOPES, comma-separated in env; must include user:email).

default_provider: Option<String>

Default OAuth provider (SOMA_MCP_AUTH_DEFAULT_PROVIDER). Unset = automatic priority: Google, Authelia, GitHub.

admin_email: String

OAuth admin email (SOMA_MCP_AUTH_ADMIN_EMAIL).

allowed_emails: Vec<String>

bootstrap_secret: Option<String>

Native-flow bootstrap secret (SOMA_MCP_AUTH_BOOTSTRAP_SECRET).

sqlite_path: Option<String>

Auth SQLite DB path (SOMA_MCP_AUTH_SQLITE_PATH).

key_path: Option<String>

Ed25519 JWT signing key path (SOMA_MCP_AUTH_KEY_PATH).

access_token_ttl_secs: Option<u64>

Access-token TTL in seconds (SOMA_MCP_AUTH_ACCESS_TOKEN_TTL_SECS).

refresh_token_ttl_secs: Option<u64>

Refresh-token TTL in seconds (SOMA_MCP_AUTH_REFRESH_TOKEN_TTL_SECS).

auth_code_ttl_secs: Option<u64>

Auth-code TTL in seconds (SOMA_MCP_AUTH_CODE_TTL_SECS).

register_rpm: Option<u32>

/register rate limit (SOMA_MCP_AUTH_REGISTER_REQUESTS_PER_MINUTE).

authorize_rpm: Option<u32>

/authorize rate limit (SOMA_MCP_AUTH_AUTHORIZE_REQUESTS_PER_MINUTE).

max_pending_oauth_states: Option<usize>

Pending OAuth state cap (SOMA_MCP_AUTH_MAX_PENDING_OAUTH_STATES).

allowed_client_redirect_uris: Vec<String>

Allowed dynamic-client redirect URIs (SOMA_MCP_AUTH_ALLOWED_REDIRECT_URIS, comma-separated in env).

token_encryption_key: Option<String>

At-rest refresh-token encryption key (SOMA_MCP_TOKEN_ENCRYPTION_KEY, 64 hex digits or 43 base64url chars — validated by soma-auth).

Trait Implementations

impl Clone for AuthConfig

fn clone(&self) -> AuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthConfig

fn default() -> AuthConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for AuthConfig

where AuthConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for AuthConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.