core: introduce public auth extension seam

crates/crank-core/src/ext/access.rs

@@ -0,0 +1 @@
+

crates/crank-core/src/ext/audit.rs

@@ -0,0 +1 @@
+

crates/crank-core/src/ext/auth.rs

@@ -0,0 +1,28 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+
+use crate::{MachineAccessMode, OperationSecurityLevel, PlatformApiKeyScope};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct VerifiedMachineCredential {
+    pub machine_access_mode: MachineAccessMode,
+    pub max_security_level: OperationSecurityLevel,
+    pub scopes: Vec<PlatformApiKeyScope>,
+}
+
+#[derive(Debug, thiserror::Error)]
+#[error("machine credential verifier failed")]
+pub struct MachineCredentialVerifierError;
+
+#[async_trait]
+pub trait MachineCredentialVerifier: Send + Sync {
+    async fn verify_bearer_token(
+        &self,
+        workspace_slug: &str,
+        agent_slug: &str,
+        token: &str,
+    ) -> Result<Option<VerifiedMachineCredential>, MachineCredentialVerifierError>;
+}
+
+pub type SharedMachineCredentialVerifier = Arc<dyn MachineCredentialVerifier>;

crates/crank-core/src/ext/capability.rs

@@ -0,0 +1 @@
+

crates/crank-core/src/ext/mod.rs

@@ -0,0 +1,5 @@
+pub mod access;
+pub mod audit;
+pub mod auth;
+pub mod capability;
+pub mod protocol;

crates/crank-core/src/ext/protocol.rs

@@ -0,0 +1 @@
+

crates/crank-core/src/lib.rs

@@ -3,6 +3,7 @@ pub mod agent;
 pub mod auth;
 pub mod cache;
 pub mod edition;
+pub mod ext;
 pub mod ids;
 pub mod observability;
 pub mod operation;
@@ -31,6 +32,10 @@ pub use cache::{
 pub use edition::{
     EditionCapabilities, EditionLimits, MachineAccessMode, OperationSecurityLevel, ProductEdition,
 };
+pub use ext::auth::{
+    MachineCredentialVerifier, MachineCredentialVerifierError, SharedMachineCredentialVerifier,
+    VerifiedMachineCredential,
+};
 pub use ids::{
     AgentId, AsyncJobId, AuthProfileId, DescriptorId, InvitationId, InvocationLogId, OperationId,
     PlatformApiKeyId, SampleId, SecretId, StreamSessionId, ToolId, UserId, UserSessionId,