---
id: server-auth
name: Bearer auth middleware and identity extraction
status: completed
depends_on: [server-core-types]
scope: narrow
risk: low
impact: component
level: implementation
tags: [server, phase-1]
---

## Description

Port `bearer_auth_middleware` and `extract_bearer_identity` +
`ResolvedIdentity` from
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/auth.rs`.
Resolution via `IdentityProvider::resolve_from_token(&AuthToken { raw })
` (alkcall::core::auth). Middleware behavior: no/invalid token →
identity None (routes decide 401 vs anonymous); token present →
ResolvedIdentity(Some(identity)). Unit tests over the middleware with a
static identity provider.

## Acceptance Criteria

- [x] Middleware ports with tests (missing header, malformed, valid token, unknown token)
- [x] `set_identity` observability path documented for the WS route's use
- [x] No env-var reads anywhere (no-env-vars invariant)
- [x] `cargo test` passes

## References

- docs/architecture/http-server.md (§Auth)
- docs/architecture/decisions/004-auth-as-shared-core.md

## Notes

> Agent fills during implementation.

## Summary

Ported `src/server/auth.rs`: `bearer_auth_middleware`,
`extract_bearer_identity`, `ResolvedIdentity` extractor — resolution
semantics preserved (no header/malformed/failed resolution → None;
routes decide 401 vs anonymous). 10 unit tests covering the matrix.
alkcall type paths. The WS route's `set_identity` observability is
documented in the module doc of adapter.rs.