Class McpClientCertificateAuthenticator

Namespace

MailFathom.Infrastructure.Security.ClientCertificates

Assembly

MailFathom.Infrastructure.dll

Judges the certificate a TLS connection carried against the trust profiles a deployment configured.

public sealed class McpClientCertificateAuthenticator

Inheritance

object

McpClientCertificateAuthenticator

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

This identifies a client application and nothing more. It is not end-user authentication, it does not replace an API key, and a deployment that runs unauthenticated stays unauthenticated with every profile in place: a certificate names the program making the request, never the person whose mail is being read.

Anchors are loaded per request rather than held, which is what makes an authority rotate without a restart, on the same terms the API keys are resolved on. Nothing here is timing-sensitive the way a credential comparison is: a certificate is public material a client sends in the clear, so profiles are evaluated in order and the first one that accepts ends the walk.

One instant is read per request and every profile judges against that one, so a certificate cannot be inside its validity period for one profile and outside it for the next. It comes from the injected clock rather than from the chain builder's ambient one, which is what makes the expiry boundary a thing a test can stand on.

A profile whose anchors have all become unloadable accepts nothing: it refuses the certificate and the failure is recorded, so unreadable material can never widen what that profile trusts. It does not refuse the request on behalf of the other profiles, because a certificate a later profile accepts was judged entirely on that profile's own anchors and the broken material took no part in the verdict. Refusing everything instead would let one deleted file close the endpoint to clients whose trust material is intact. Startup proves every anchor loads, so reaching this state at all means the deployment changed underneath a running process, which is why it is recorded at error level.

Constructors

McpClientCertificateAuthenticator(TrustAnchorLoader, TimeProvider, ILogger<McpClientCertificateAuthenticator>)

Initializes a new client certificate authenticator.

Methods

AuthenticateAsync(IReadOnlyList<McpClientCertificateTrustProfile>, X509Certificate2?, CancellationToken)

Judges the certificate a connection presented.