A2aEngine.Auth.Bearer (a2a_engine v0.1.0)

Copy Markdown View Source

Bearer-token authentication.

Configuration (passed as opts to authenticate/2):

  • :tokens — a map of token_string => principal_name. Principal is returned in the auth_context for handler use (agent name, caller id).
  • :validator — alternative to :tokens: a 1-arity function (token :: String.t()) :: {:ok, principal} | :error.
  • :realm — string included in the WWW-Authenticate hint when transports emit 401 responses (optional).

One of :tokens or :validator MUST be present.

Behaviour

  • Reads the authorization header (case-insensitive via transport normalisation).
  • Accepts only the Bearer <token> scheme. Other schemes → :unauthenticated.
  • Missing header or unknown token → :unauthenticated.
  • On success → %{scheme: :bearer, principal: "<name>", extra: %{}}.