#Auth & Security

Version: 0.33.0 Updated: 2026-03-15 Applies to: ranvier-std, ranvier-core Category: Deep Dives

Replace hidden middleware with visible, traceable Guard Transition nodes and IAM boundary verification.

#Guard Nodes (ranvier-std)

All guards implement Transition<T, T> — pass input through on success, return Fault on reject.

#IAM Framework (ranvier-core::iam)

• IamVerifier trait: Implement verify(token) -> Result<IamIdentity, IamError> for your auth backend.
• IamPolicy: None, RequireIdentity, RequireRole(String), RequireClaims(Vec<String>).
• Axon::with_iam(policy, verifier): Automatic boundary verification before any Transition runs.
• IamIdentity: Subject, roles, claims — inserted into Bus for downstream access.
• IamToken: Bus-injectable bearer token read by the Axon IAM boundary.

#Session Patterns

• Session creation and validation as Transition nodes (not middleware).
• Cookie-based or header-based token extraction via Bus injection.
• Expiration and cleanup logic as explicit Transition steps.

#Quickstart

// Guard pipeline
Axon::new("Guarded API")
    .then(CorsGuard::new(CorsConfig::default()))
    .then(RateLimitGuard::new(100, 60_000))
    .then(SecurityHeadersGuard::new(SecurityPolicy::new()))
    .then(IpFilterGuard::allow_list(["127.0.0.1"]))
    .then(BusinessLogic);

#Workflows

1. Add Guard nodes to your Axon pipeline with .then() for layered HTTP security.
2. Implement IamVerifier for your JWT/OAuth/API-key backend.
3. Attach IamPolicy via Axon::with_iam() for automatic boundary verification.
4. Read IamIdentity from Bus in downstream Transitions for user context.
5. Inject RequestOrigin, ClientIp, ClientIdentity from your HTTP adapter layer.

#Key Types