Struct BearerPolicy 

pub struct BearerPolicy {
    pinned: Option<Arc<str>>,
    floor: Option<Arc<str>>,
    settings: Option<Arc<SettingsCache>>,
}

Which token a running endpoint currently requires.

Why this is not just a string

The expected token used to be resolved once, at bind, and baked into the middleware — so a key rotated afterwards was never honoured and a key set afterwards was never enforced. Worse, the guard was only installed when a token existed at bind, so an endpoint that started open could not be closed without a restart.

The fix cannot be an in-process notification. gglib config settings set writes the database from a separate process, so nothing the daemon subscribes to would ever see it — the same reasoning SettingsCache already records for every other setting. Reading through that cache is what makes a rotation take effect here at all.

The staleness is bounded, not zero. A revoked key keeps working for up to SETTINGS_CACHE_TTL. That is the accepted trade, and it is strictly better than what it replaces, where a rotation performed through the CLI never took effect at all.

Fields

pinned: Option<Arc<str>>

A token supplied by flag or environment. It does not live in settings, so nothing in settings may override it.

floor: Option<Arc<str>>

The token in force at bind, kept as a floor.

settings: Option<Arc<SettingsCache>>

The live view of the stored token.

Implementations

impl BearerPolicy

pub fn pinned(key: &str) -> Self

A token the operator supplied directly, which never tracks settings.

--api-key and GGLIB_API_KEY outrank the stored value by design, so letting a settings write replace one would both invert that precedence and lock out the operator who passed it.

pub fn tracking(bind_key: Option<&str>, settings: Arc<SettingsCache>) -> Self

A token read from settings — or absent — which tracks later writes.

bind_key is whatever was in force when the endpoint bound, and is kept as a floor: if the stored value later disappears, this endpoint keeps demanding the token it started with rather than falling open. Authentication can be switched on at runtime and never off, which is the asymmetry a listener bound off loopback needs — clearing the setting must not silently expose it.

pub fn fixed(key: Option<&str>) -> Self

A token that can never change and is never required. For hosts with no settings to read, such as tests and embedded servers.

pub async fn current(&self) -> Option<Arc<str>>

The token a request must present right now, or None while this endpoint is unauthenticated.

pub async fn admits(&self, presented: Option<&str>) -> bool

Whether presented gets in.

An endpoint with no token configured admits everyone, which is the loopback default and the behaviour this had before authentication existed.

Trait Implementations

impl Clone for BearerPolicy

fn clone(&self) -> BearerPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.