Function resolve_auth

nodedb/src/control/server/http/auth.rs:92–129

Resolve both authenticated identity and auth context from HTTP headers. Uses `AuthContext::from_jwt()` when JWT claims are available (richer context), falls back to `build_auth_context()` for API key / password auth.

(
    headers: &HeaderMap,
    state: &AppState,
    peer_addr: &str,
)

/// Uses `AuthContext::from_jwt()` when JWT claims are available (richer context),
/// falls back to `build_auth_context()` for API key / password auth.
pub fn resolve_auth(
    headers: &HeaderMap,
    state: &AppState,
    peer_addr: &str,
) -> Result<
    (
        AuthenticatedIdentity,
        crate::control::security::auth_context::AuthContext,
    ),
    ApiError,
> {
    use crate::control::security::auth_context::{AuthContext, generate_session_id};

    // Check for JWT Bearer to get rich AuthContext.
    if let Some(auth_header) = headers.get("authorization")
        && let Ok(auth_str) = auth_header.to_str()
        && let Some(token) = auth_str.strip_prefix("Bearer ")
    {
        let token = token.trim();
        if let Some(identity) = try_validate_jwt(state, token) {
            let auth_ctx = if let Some(ref registry) = state.shared.jwks_registry
                && let Ok(claims) = registry.decode_claims(token)
            {
                AuthContext::from_jwt(&claims, generate_session_id())
            } else {
                tracing::trace!("JWT claims decode unavailable, using basic auth context");
                session_auth::build_auth_context(&identity)
            };
            let auth_ctx = apply_on_deny_header(headers, auth_ctx);
            return Ok((identity, auth_ctx));
        }
    }

    // Fallback: resolve identity normally and build basic AuthContext.
    let identity = resolve_identity(headers, state, peer_addr)?;
    let auth_ctx = apply_on_deny_header(headers, session_auth::build_auth_context(&identity));
    Ok((identity, auth_ctx))
}

/// Check `X-On-Deny` header and set the `on_deny_override` on AuthContext.
fn apply_on_deny_header(