---
id: server-auth
name: Bearer auth middleware and identity extraction
status: pending
depends_on: [server-core-types]
scope: narrow
risk: low
impact: component
level: implementation
tags: [server, phase-1]
---

## Description

Port `bearer_auth_middleware` and `extract_bearer_identity` +
`ResolvedIdentity` from
`/workspace/@alkdev/alknet/crates/alknet-http/src/server/auth.rs`.
Resolution via `IdentityProvider::resolve_from_token(&AuthToken { raw })
` (alkcall::core::auth). Middleware behavior: no/invalid token →
identity None (routes decide 401 vs anonymous); token present →
ResolvedIdentity(Some(identity)). Unit tests over the middleware with a
static identity provider.

## Acceptance Criteria

- [ ] Middleware ports with tests (missing header, malformed, valid token, unknown token)
- [ ] `set_identity` observability path documented for the WS route's use
- [ ] No env-var reads anywhere (no-env-vars invariant)
- [ ] `cargo test` passes

## References

- docs/architecture/http-server.md (§Auth)
- docs/architecture/decisions/004-auth-as-shared-core.md

## Notes

> Agent fills during implementation.

## Summary

> Agent fills on completion.