adk_a2a_v1_auth behaviour (erlang_adk v0.7.0)

Authentication/authorization boundary for the A2A 1.0 server.

Hooks receive the operation, raw request headers, and a bounded request summary. They must return a stable principal id separately from the principal passed to the executor. Only a SHA-256 scope is retained by the task store; raw headers, credentials, and the principal are never retained in A2A task or event data.

Summary

Callbacks

authorize/3

Functions

authorize(Hook, Operation, Headers, Summary)

authorize(Hook, Operation, Headers, Summary, Options)

scope(PrincipalId)

Callbacks

authorize/3

-callback authorize(binary(), map(), map()) -> {ok, term(), binary()} | {error, unauthenticated | forbidden}.

Functions

authorize(Hook, Operation, Headers, Summary)

-spec authorize(none | module() | fun((binary(), map(), map()) -> term()), binary(), map(), map()) ->
                   {ok, map()} | {error, unauthenticated | forbidden}.

authorize(Hook, Operation, Headers, Summary, Options)

-spec authorize(none | module() | fun((binary(), map(), map()) -> term()),
                binary(),
                map(),
                map(),
                map()) ->
                   {ok, map()} | {error, unauthenticated | forbidden}.

scope(PrincipalId)

-spec scope(binary()) -> binary().