strata_server/auth

Connection-time authentication for strata.

v0 uses a single shared secret presented as a ?token= query parameter on the WebSocket upgrade request. This module exposes a pure verification function that the mist transport layer wraps in its on_connect callback.

Future plans:

• JWT (multi-tenant) — replace verify with a JWT-aware verifier that extracts a tenant + subject from the token. The on-the-wire shape stays the same (?token=...), so clients don't change.
• Per-tenant signing keys — keyed off a tenant query param or a path segment.

Types

AuthResult

Outcome of an authentication attempt. The Ok variant carries the authenticated session identity (currently a single shared identity; in a future multi-tenant build it will carry tenant + subject).

pub type AuthResult {
  Authenticated(session: Identity)
  Rejected(reason: RejectReason)
}

Identity

Identity attached to an authenticated socket.

pub type Identity {
  Identity(session_id: String)
}

QueryError

Errors returned when parsing the request query string.

pub type QueryError {
  MalformedQueryText(query: String)
}

RejectReason

Why a connection was rejected.

pub type RejectReason {
  MissingToken
  InvalidToken
}

Functions

extract_token

Extract the token query parameter from a request. Returns Ok(None) if no query string is present or if token is absent. Returns Error(MalformedQueryText(_)) if the query string cannot be parsed.

pub fn extract_token(request.Request(a)) -> Result(option.Option(String), QueryError)

verify

Verify a token against the configured shared secret.

Returns Authenticated(...) on a successful match. Rejection is reported with MissingToken (no token supplied) or InvalidToken (token did not match).

Token comparison is constant-time via gleam/crypto.secure_compare.

pub fn verify(
  option.Option(String),
  String,
  String
) -> AuthResult