Module context 

Request-scoped context: authenticated identity, structured principal, transport extensions, plus the AuthProvider trait that auth middlewares implement.

Structs

CachedAuthProvider

An AuthProvider that always returns a single, already-established CratestackContext, ignoring whatever RequestContext it is asked to authenticate.

CratestackAuthIdentity

CratestackContext

CratestackContextBuilder

Builds an authenticated CratestackContext; start one with CratestackContext::builder. A later call for the same claim replaces the earlier value, except Self::tenant and the cnf setters, which merge into the existing map.

PrincipalContext

PrincipalFacet

RequestContext

Everything an AuthProvider gets to see about an inbound request.

ReservedClaim

One reserved claim: its path (a dotted path for a facet member such as tenant.id) and the type it must have.

SystemContext

A context representing trusted in-process/server code (a procedure, a worker, a reconciliation job) rather than an end user.

VerifiedSigner

The key that signed a request body, as verified by CratestackEnvelope::open.

Enums

ClaimType

The type a reserved claim must have.

KeyRole

Which device key proved this request (the key_role claim): one that never prompts, or one that prompts for user presence on every signature.

Constants

RESERVED_CLAIMS

The reserved claim names, in the ADR’s order. id is deliberately not one of them: many schemas declare auth User { id Int }.

Traits

AuthProvider

Resolves the caller of a request into a CratestackContext.