Enum Credential 

pub enum Credential {
    Public,
    AccountToken,
    AccountSelf,
    Creator,
    Proof,
    KeyProofOrOperator,
    Disclosure,
}

A credential kind a route may declare it accepts.

Variants

Public

No principal required. A deliberate decision, not an absence of one.

AccountToken

didbot_pds::credential’s bearer token, minted at provisioning, or a DPoP-bound OAuth access token; see require_agent_token_or_dpop.

AccountSelf

An agent’s own Credential::AccountToken, resolved to the account it authenticates as rather than to a repository path.

Two postures, and which one a route takes depends on whether the request names an account at all.

Checked against the account the request names. Every account-lifecycle mutation: activateAccount, deactivateAccount, deleteAccount, freezeAccount and unfreezeAccount. The request carries a DID and the token must authenticate as that same account — see auth::require_self. A client calls them carrying the credential createAccount handed back, and an agent tearing down or toggling itself is the only caller this server can authenticate for them.

Used as identity, with nothing to compare it against. The four authorization-decision routes: approveAuthorization, declineAuthorization, getAuthorization and listPendingAuthorizations. These name no account, so there is no comparison to make and none is made: what they read and answer are the decisions addressed to the account the presented token authenticates as, and an agent cannot ask for anybody else’s because there is nowhere in the request to ask. createBrowserSignIn is the same: its ticket signs a browser in as that account.

Either way, there is no operator credential to carve an exception for; see the module doc.

Creator

createAccount alone: a credential naming the creator, in any of the shapes crate::tree::prove resolves. See the module doc.

Proof

createSession alone: a key-signed JWT or an OpenID Connect token naming a hosted account; see crate::tree::prove.

KeyProofOrOperator

updateCredentials alone: a JWT one of the account’s keys signed, or the operator session with its CSRF header.

Disclosure

Public by default, and narrowable by this deployment’s own configuration to operator-only — never the reverse. listAccounts, listAccountLedgers, getAccountLedger and stats: disclosure rather than mutation, and this project’s accountability story rather than an accident — see Disclosure and require_disclosure for the reasoning and the mechanism, and plan/auth-types.md’s “publish by default” for the write-up this epic owes an audience beyond this table.

Trait Implementations

impl Clone for Credential

fn clone(&self) -> Credential

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Credential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Credential

fn eq(&self, other: &Credential) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for Credential

impl Eq for Credential

impl StructuralPartialEq for Credential