Namespace Shard.Network.Auth

Classes

AuthConfig

Authentication endpoints and OAuth client settings, derived from a domain. Mirrors the upstream AuthConfig (service URLs built from a base domain, scopes, user agent).

JwtClaims

Validated claims extracted from a token.

JwtValidator

Validates EdDSA (Ed25519) JWTs against the service JWKS. The BCL has no Ed25519, so signatures are verified with NSec. JWKS is fetched on demand and cached, refreshed on a key-id miss (key rotation). Claims (iss/aud/exp/nbf/sub/username/scope) are read with a reflection-free DOM.

NetworkAuthModule

The authentication module provides the IConnectionHandlerFactory when it starts, while its preload completes OAuth and game session authentication before the server becomes ready and networking is enabled. Quiescence rejects new handshake work, cancels and drains active work, and then releases the server session slot.

ServerAuthenticator

Authenticates the server itself at startup and owns the server's game session ("slot"). In Offline it is a no-op. In Authenticated it obtains an access token (env or OAuth device flow), then acquires a game session. ReleaseAsync(CancellationToken) frees the slot on shutdown so it does not count against the account's session limit.

Enums

AuthMode

How the server authenticates itself at startup.

Delegates

PlayerJoinAdmission

Admits one authenticated setup connection into the gameplay runtime.