Module auth 

Service-layer authorization (CRIT-006).

Provides authorization context that can be passed to service methods for fine-grained access control. This complements MCP-layer JWT auth by enforcing permissions at the service boundary.

Design Principles

• Opt-in: Services work without auth context (CLI/local use)
• Defense in depth: Complements transport-layer auth
• Audit trail: All authorization decisions are logged

Usage

use subcog::services::auth::{AuthContext, Permission};

// Create context from JWT claims
let ctx = AuthContext::from_scopes(vec!["read".to_string(), "write".to_string()])
    .with_subject("user-123");

// Check permission before operation
ctx.require(Permission::Write)?;

// Or use the builder pattern
let ctx = AuthContext::builder()
    .subject("user-123")
    .scope("read")
    .scope("write")
    .build();

Structs

AuthContext

Authorization context for service operations.

AuthContextBuilder

Builder for constructing an AuthContext.

Enums

Permission

Permissions for service operations.