soma_palette/auth.rs
1//! Product auth/session behavior for Palette requests.
2//!
3//! When the `auth` feature is enabled, this re-exports `soma_auth::AuthContext`
4//! (populated by `soma-auth`'s middleware, mounted by the composing app) and
5//! reads it the same way `soma-api` does. Without the feature, a minimal
6//! local stand-in keeps this crate buildable standalone (matching
7//! `soma-api`'s own pattern).
8
9#[cfg(feature = "auth")]
10pub use soma_auth::AuthContext;
11
12#[cfg(not(feature = "auth"))]
13#[derive(Clone)]
14pub struct AuthContext {
15 pub sub: String,
16 pub scopes: Vec<String>,
17}
18
19use crate::state::PaletteState;
20
21/// Build the [`soma_application::ExecutionContext`] for a Palette request,
22/// pulling subject/scopes from `auth` when present (unauthenticated requests
23/// under a loopback-dev or trusted-gateway policy pass `None`).
24pub fn palette_execution_context(
25 state: &PaletteState,
26 auth: Option<&AuthContext>,
27) -> soma_application::ExecutionContext {
28 let scopes = auth.map(|auth| auth.scopes.as_slice()).unwrap_or_default();
29 state.execution_context(auth.map(|auth| auth.sub.as_str()), scopes)
30}
31
32#[cfg(test)]
33#[path = "auth_tests.rs"]
34mod tests;