Installation
The Security plugin provides a framework-neutral execution pipeline. You choose how credentials are read and verified, what identity data represents, and which rules grant access. The package works with AxiSpark transports; install the transport plugin and adapter that your application uses as well.
Authentication
Authentication is implemented by application-defined subclasses of Authenticator. An authenticator receives AxiSpark's ExecutionContext, reads credentials from the relevant transport context, validates them, and returns an identity value. This package does not select a token format or prescribe where identities come from.
Authorization
Authorization is a set of application-defined rules evaluated against a SecurityContext. A policy can check roles, permissions, ownership, tenant membership, resource state, or any other condition. Policies are ordinary injectable classes; the package does not introduce a fixed role or permission model.
Execution pipeline and context
The security package participates in AxiSpark's middleware and guard stages. Authentication and authorization remain separate: middleware enriches the execution context; guards enforce the resulting security state before the handler runs.
Errors and transport mapping
The security guards report failures using framework-neutral errors. This package does not convert them into HTTP responses or message acknowledgements, because the correct representation depends on the transport and application.