Struct AdminAuth 

pub struct AdminAuth {
    pub identity: String,
    pub role: AdminRole,
}

Authenticated admin context extracted from request headers.

Verifies admin credentials (Bearer token or admin mTLS) before the handler runs. On failure, returns 401 or 403.

Carries the caller’s AdminRole; mutating handlers must call AdminAuth::require_operator before performing any change.

Fields

identity: String

The authenticated admin identity (username or cert subject).

role: AdminRole

The role granted to this identity.

Implementations

impl AdminAuth

pub fn require_operator(&self) -> Option<Response>

Enforce that the caller holds the AdminRole::Operator role.

Returns Some(403) for an auditor (or any non-operator) and None when the caller is an operator. Call this at the top of every mutating admin handler so read-only roles cannot alter state (FMT_SMR.1):

if let Some(resp) = admin.require_operator() {
    return resp;
}

Trait Implementations

impl Clone for AdminAuth

fn clone(&self) -> AdminAuth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AdminAuth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S> FromRequestParts<S> for AdminAuth

where S: Send + Sync, Arc<AppState>: FromRef<S>,

type Rejection = Response<Body>

If the extractor fails it’ll use this “rejection” type. A rejection is a kind of error that can be converted into a response.

async fn from_request_parts( parts: &mut Parts, state: &S, ) -> Result<Self, Response>

Perform the extraction.