Module auth 

Who may see a package: bearer token → sha256 → credential row → decision. Raw tokens are never stored or logged; only hash_token of one leaves a request.

Modules

access_decision 🔒

bearer_header 🔒

token_lookup 🔒

token_secret 🔒

Structs

TokenRow

A credential and its grants, as stored.

Enums

Decision

Constants

TOKEN_PREFIX

Marks a Pacenotes access key, for users and for secret scanners.

Functions

bearer_from_headers

The raw token from Authorization: Bearer <token>, if well-formed. It is a credential: never log it or put it in an error.

decide

public is always allowed; any other directory needs a live credential granted it, and a live credential without that grant sees the directory as absent.

hash_token

Lowercase hex sha256: the only form of a credential the server keeps.

load_token

The credential with this hash and all its grants, in one query; None when no such credential exists.

mint_token

pcn_ + 32 random bytes as unpadded base64url; the caller shows it once and stores only hash_token of it.

now

Current unix seconds.

well_formed

Whether mint_token could have produced this, checked before any database lookup so a garbage header costs no query, which remote libSQL bills.