Enum Credential 

pub enum Credential {
    ApiKey {
        key: String,
    },
    Hmac {
        key_id: String,
        secret: String,
    },
    Jwt {
        issuer: String,
        audiences: Vec<String>,
    },
    Mtls {
        fingerprint: Option<String>,
        subject: Option<String>,
    },
}

One authenticator bound to a consumer: API key, JWT issuer/audience binding, mTLS client-certificate match, or HMAC signing key (DW-036).

Debug is manual (DW-045): the api-key and hmac-secret values are SECRET and a derived impl would print them — this keeps the config tree safe to Debug-log as a whole (Gateway and every holder derive Debug over this type).

Variants

ApiKey

Fields

key: String

The API key; hashed at rest by the state layer, never logged. Either the value INLINE (accepted, but redacted to a ${redacted:...} placeholder in every config echo — admin GET /config, DW-045) or a reference resolved at config-compile time: ${ENV_NAME} (an environment variable) or ${file:/path/to/secret} (one trailing newline trimmed). References are re-read on every reload; an unresolvable reference fails validation naming this field.

Hmac

HMAC request-signing credential (DW-036): the consumer presents per-request signatures over the canonical string documented in the security::authn module docs, carried in the X-Dwara-Signature header family. Unlike API keys the secret cannot be hash-at-rest stored — recomputing an HMAC needs the RAW key bytes — so this credential is config-declared only (the state store’s hashed rows cannot serve it) and the resolved bytes live solely in the authenticator’s memory, zeroized on drop. The pepper (#124) deliberately does NOT apply here: it guards stored hashes, and there is no stored hash to guard.

Fields

key_id: String

Public key identifier: the X-Dwara-Key-Id header value the client presents to SELECT this credential (the AWS access-key-id shape — it names the key, it is not secret). Non-empty visible ASCII, at most 128 bytes; unique across every consumer (validation rejects duplicates — an ambiguous selector cannot pick a consumer deterministically).

secret: String

The HMAC-SHA256 signing secret. INLINE values are accepted (redacted in every config echo, like api keys) but ${ENV_NAME} / ${file:/path/to/secret} references are the recommended shape; resolved at config-compile time and re-read on every reload. Must be non-empty; use at least 32 bytes of entropy (shorter keys weaken the MAC construction — documented, not enforced, the same posture as the pepper).

Jwt

Fields

issuer: String

audiences: Vec<String>

Mtls

Fields

fingerprint: Option<String>

SHA-256 fingerprint (lowercase hex of the DER) of the client certificate. Optional when subject is set (#124); a fingerprint match binds the credential to ONE exact certificate (a re-issued cert needs a new credential).

subject: Option<String>

Subject CommonName of the client certificate (#124): the credential matches any verified client certificate whose subject CN is exactly this string (case-sensitive). Binding by subject survives certificate re-issue under the same CN; the certificate must still chain to a listener’s client_ca_file (or be otherwise verified) at the TLS layer — the matcher only maps an ALREADY-VERIFIED certificate to a consumer. Exactly one of subject / fingerprint must be set (validation rejects both-empty and both-set).

Trait Implementations

impl Clone for Credential

fn clone(&self) -> Credential

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Credential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Credential

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Credential

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for Credential

fn eq(&self, other: &Credential) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Credential

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Credential