Module auth 

Inbound API authentication (#2, ADR-0010).

A route_layer middleware resolves a Principal from the request’s credential, checks it against the route’s required_access, writes one audit log line per mutation, and runs the handler inside prospero_core::actor::scope so directly emitted events carry the token name.

Modules

handlers

/api/session — dashboard sign-in, whoami and sign-out (#2).

session

Stateless dashboard session cookies (#2).

Structs

AuthState

Authentication configuration shared by the middleware and session handlers.

Principal

The authenticated caller, inserted as a request extension.

SessionKey

HMAC key for dashboard session cookies. Never logged.

Enums

Access

A route’s requirement.

Via

How the principal authenticated.

Constants

ON_BEHALF_OF_HEADER

Header by which a client says which person it is acting for (#251).

Functions

middleware

The auth middleware (installed with route_layer, so MatchedPath is set).

required_access

The scope table, keyed on axum’s matched route pattern. Unlisted routes fail closed to admin.