1# aldebaran-access
2
3Who may come in: nobody Cloudflare Access has not signed in. Access puts a
4signed token in `Cf-Access-Jwt-Assertion` on every request it lets through; the
5Worker checks it itself, so the site is not open to anything that reaches it
6by another road.
7
8| Item | What it is |
9|---|---|
10| `admitted(token, keys, team, audience, now_s)` | The email (or service token's name) of whoever Access signed in, or a `Refused`. |
11| `Refused` | Closed: not configured, not a token, wrong algorithm, unknown key, bad key, bad signature, other application, other team, expired. |
12| `certs(team)`, `kid(token)`, `Keys`, `Key` | Where the team's keys are read from, which key a token names, and their shape. Fetching is the adapter's. |
13| `HEADER` | The header name. |
14
15RS256 only, pure Rust, builds for wasm.