Execution pipeline and context
The security package participates in AxiSpark's middleware and guard stages. Authentication and authorization remain separate: middleware enriches the execution context; guards enforce the resulting security state before the handler runs.
Step order
| Order | Stage | Work |
|---|---|---|
| 1 | Authentication middleware (Normal) | Detects @Secured() metadata and runs authenticators if enabled for the transport. |
| 2 | Authorization middleware (Low) | Evaluates class and method policies and records all decisions. |
| 3 | Authentication guard (Normal) | Rejects a secured execution without a successful authenticator. |
| 4 | Authorization guard (Low) | Rejects a secured execution if any policy denied it. |
| 5 | Handler | Runs after both guards allow the execution. |
AxiSpark orders steps by descending numeric priority. Normal has a higher numeric value than Low, so authentication runs before authorization within each stage. The middleware stage as a whole precedes the guard stage.
Security context fields
SecurityContext<T> extends the engine's ExecutionContext and adds:
| Field | Writer | Meaning |
|---|---|---|
securedMethod | Authentication engine | Whether the target class or method has @Secured() metadata. |
authenticated | Authentication engine | Whether an authenticator returned a truthy value. |
authenticationMethod | Authentication engine | Class of the authenticator that succeeded. |
data | Authentication engine | Application-defined identity value returned by the successful authenticator. |
authorized | Authorization engine | Whether all evaluated policies allowed access. |
authorizationDecisions | Authorization engine | Every policy decision in evaluation order. |
The T generic describes the application's own data shape. Authentication and authorization logic can therefore share a typed principal without the package defining what a principal must contain. The context can also be narrowed or cast to a transport-specific context when accessing HTTP headers, route parameters, message headers, and similar values.
Public and secured targets
The middleware pipeline can attempt authentication for public targets, which allows optional authentication. The guards only enforce authentication and authorization when a target is marked with @Secured(). A secured target with no policy list still requires successful authentication. A target without @Secured() remains public, even if a policy class exists elsewhere in the application.
Dependency injection and order
Selected authenticators run in the order in selected; discovered authenticators under all run in class-registry order. Policies run in class-then-method declaration order. Each authenticator and policy is resolved by the application injector, so injectable constructor dependencies are available. Keep authenticator selection explicit where deterministic ordering is important.