Module authn 

Authentication requirements (ADR 0022, cratestack#1244): how recently and how strongly a caller must have authenticated for one operation, and the step-up refusal when it has not.

A schema states the requirement next to the operation’s policy; the generated code holds it as an AuthnRequirement and calls require_authn after the operation’s @allow/@deny admitted the caller. The facts come from the principal contract (ADR 0021 §2), which the provider fills: auth_time for a freshness, amr for methods, acr for a class. A missing fact fails closed.

The refusal is RFC 9470’s: a 401 whose envelope carries error: "insufficient_user_authentication", a details naming what is required and what was unmet, and a WWW-Authenticate: Bearer challenge with max_age / acr_values. A client retries at most once, after the user re-proved.

Structs

AuthnRequirement

What one operation requires of the caller’s authentication. Every part is optional; a requirement with none is satisfied by any caller.

Enums

Unmet

Which part of a requirement the caller did not meet, in the order the refusal’s details.unmet lists them.

Constants

STEP_UP_ERROR

The envelope member error’s value, and the challenge’s error parameter: RFC 9470’s code.

STEP_UP_MESSAGE

The refusal’s message, and the challenge’s error_description.

Functions

require_authn

Ok when there is no requirement or ctx meets it now, otherwise the step-up refusal. The generated code calls it with the operation’s AUTHN, None for an operation without one.

require_authn_at

require_authn for one requirement at a given time, for tests and callers with their own clock.