Struct Authenticator 

pub struct Authenticator { /* private fields */ }

Checks request credentials against the configured users.

Implementations

impl Authenticator

pub fn new(auth: &Auth) -> Self

Builds an authenticator from the [auth] section.

pub fn is_disabled(&self) -> bool

Whether no credentials are required at all.

True when no users are configured, which makes this an open proxy; config::Config::warnings reports it at startup.

pub fn authenticate(&self, fields: &Fields) -> Result<Option<&str>, Denials>

Authenticates a request’s headers.

Ok(None) means authentication is disabled, Ok(Some(username)) names the user that matched. The error carries one entry per credential value that was tried and refused, because that is the unit the failure budget counts (decision D76, addendum of 2026-09-04).

A value that matches ends the loop, so the values after it are neither tried nor charged: this returns what the request is, and a request that authenticates is not a failure.