001/*
002 * Licensed to the Apache Software Foundation (ASF) under one or more
003 * contributor license agreements.  See the NOTICE file distributed with
004 * this work for additional information regarding copyright ownership.
005 * The ASF licenses this file to You under the Apache License, Version 2.0
006 * (the "License"); you may not use this file except in compliance with
007 * the License.  You may obtain a copy of the License at
008 *
009 *      http://www.apache.org/licenses/LICENSE-2.0
010 *
011 * Unless required by applicable law or agreed to in writing, software
012 * distributed under the License is distributed on an "AS IS" BASIS,
013 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014 * See the License for the specific language governing permissions and
015 * limitations under the License.
016 */
017package org.apache.juneau.rest.server.auth;
018
019import java.util.*;
020
021import jakarta.servlet.http.*;
022
023/**
024 * Lowest-level authentication contract shared by the servlet-filter layer ({@link AuthFilter},
025 * {@link AuthFilterChain}) and the resource layer ({@link RestAuthenticator}).
026 *
027 * <p>
028 * Three-state return contract:
029 * <ul>
030 *    <li>{@link Optional#empty()} &mdash; this authenticator does not apply (no recognizable credentials).
031 *    <li>{@link Optional#of(Object) Optional.of(AuthResult)} &mdash; authentication succeeded.
032 *    <li>throw {@link AuthenticationException} &mdash; credentials were present but invalid.
033 * </ul>
034 *
035 * <h5 class='section'>See Also:</h5><ul>
036 *    <li class='jc'>{@link AuthFilter}
037 *    <li class='jc'>{@link AuthFilterChain}
038 *    <li class='jc'>{@link RestAuthenticator}
039 *    <li class='link'><a class="doclink" href="https://juneau.apache.org/docs/topics/RestServerAuthenticator">REST Authenticator — Resource-Level Authentication</a>
040 * </ul>
041 *
042 * @since 10.0.0
043 */
044@FunctionalInterface
045public interface Authenticator {
046
047   /**
048    * Inspects the request and returns the authentication result.
049    *
050    * @param req The incoming HTTP request. Never <jk>null</jk>.
051    * @return The authentication result, or {@link Optional#empty()} if this authenticator does not apply.
052    * @throws AuthenticationException If the request carries recognizable credentials that are invalid.
053    */
054   Optional<AuthResult> authenticate(HttpServletRequest req) throws AuthenticationException;
055}