Safe-by-default local verification of an AXIAM access token. More...

#include <authenticator.hpp>

Public Member Functions
	TokenAuthenticator (JwksVerifier &jwks, std::string expected_tenant_id, AuthenticatorOptions options={})

AxiamUser	authenticate (const std::string &token) const
	Verify `token` and build the authenticated identity.

std::optional< AxiamUser >	try_authenticate (const std::string &token) const
	Non-throwing twin, for wiring into AxiamGuard / framework adapters.

const std::string &	expected_tenant_id () const noexcept
	The tenant every token is bound to.

template<typename Request >
AxiamGuard< Request >::Authenticator	guard_authenticator (std::function< std::optional< std::string >(const Request &)> extract_token) const
	Build a §10 guard authenticator: given a way to pull the raw credential out of a framework request, returns the functor AxiamGuard expects.

Static Public Member Functions
static std::optional< std::string >	bearer_from_authorization (const std::string &header_value)
	Extract a bearer token from an `Authorization` header value.

static std::optional< std::string >	token_from_cookie_header (const std::string &cookie_header)
	Extract the `axiam_access` token from a `Cookie` request header value.

Detailed Description

Safe-by-default local verification of an AXIAM access token.

Holds a non-owning pointer to the JwksVerifier it was built from; that verifier (usually client.jwks()) must outlive the authenticator.

Constructor & Destructor Documentation

◆ TokenAuthenticator()

axiam::TokenAuthenticator::TokenAuthenticator	(	JwksVerifier &	jwks,
		std::string	expected_tenant_id,
		AuthenticatorOptions	options = `{}`
	)

Parameters

jwks	key source, typically `client.jwks()`.
expected_tenant_id	the tenant this resource server serves. Every token's `tenant_id` claim must equal it exactly.

Exceptions

std::invalid_argument when expected_tenant_id is empty — an empty expectation would silently disable the tenant check — or when options.clock_skew is negative or exceeds kMaxClockSkew.

Member Function Documentation

◆ authenticate()

AxiamUser axiam::TokenAuthenticator::authenticate ( const std::string & token ) const

Verify token and build the authenticated identity.

Exceptions

AuthError on any verification failure. The message never contains token material.

◆ try_authenticate()

std::optional< AxiamUser > axiam::TokenAuthenticator::try_authenticate ( const std::string & token ) const

Non-throwing twin, for wiring into AxiamGuard / framework adapters.

◆ expected_tenant_id()

const std::string & axiam::TokenAuthenticator::expected_tenant_id ( ) const

inlinenoexcept

The tenant every token is bound to.

◆ bearer_from_authorization()

static std::optional< std::string > axiam::TokenAuthenticator::bearer_from_authorization ( const std::string & header_value )

static

Extract a bearer token from an Authorization header value.

Returns nullopt when the scheme is absent or is not Bearer.

◆ token_from_cookie_header()

static std::optional< std::string > axiam::TokenAuthenticator::token_from_cookie_header ( const std::string & cookie_header )

static

Extract the axiam_access token from a Cookie request header value.

◆ guard_authenticator()

template<typename Request >

AxiamGuard< Request >::Authenticator axiam::TokenAuthenticator::guard_authenticator ( std::function< std::optional< std::string >(const Request &)> extract_token ) const

inline

Build a §10 guard authenticator: given a way to pull the raw credential out of a framework request, returns the functor AxiamGuard expects.

The resulting functor borrows this authenticator, so keep it alive.

The documentation for this class was generated from the following file:

include/axiam/authenticator.hpp

Public Member Functions

Static Public Member Functions