12 / EDGE

auth

The auth middleware requires every HTTP request to carry a valid Authorization: Bearer <jwt>, rejecting absent/malformed/tampered/expired tokens with 401 before the app runs.

WHERE IT SITS

servicemiddlewaregrouproutehoopsfilesmountgunzipsignaturersajwtauthmetricstracing

INTERFACE

fn jwt_authorized( token : String?, secret : String, now_secs : Int64) -> Bool

fnWhether a request bearing token is authorised at now_secs: the token verifies against secret under HS256 and is neither expired nor not-yet-valid. A missing token is unauthorised. Exposed as a pure decision so the middleware's accept/reject is testable without driving the transport.

fn auth(secret : String, clock : @clock.Clock) -> Middleware

fnJWT auth middleware: require every HTTP request to carry a valid Authorization: Bearer <jwt> header. The token is verified against secret under HS256 at the current time read from clock (milliseconds, converted to the JWT seconds epoch); an absent, malformed, tampered, expired, or not-yet-valid token is rejected with 401 Unauthorized before the wrapped app runs. Non-HTTP scopes (lifespan, websocket) pass through untouched.

service middleware group route hoops files mount gunzip signature rsa jwt metrics tracing