add el-identity: Engram-native identity, OAuth, @authenticate by default

ui/crates/el-auth/src/jwt.rs

@@ -12,12 +12,19 @@ use sha2::Sha256;
 type HmacSha256 = Hmac<Sha256>;
 
 /// JWT claims payload.
+///
+/// The `session_id` field is included so the Engram session node can be
+/// validated on every request, enabling server-side session invalidation
+/// even for stateless JWTs.
 #[derive(Debug, Clone)]
 pub struct JwtClaims {
     pub sub: String,   // user ID
     pub email: String,
     pub name: String,
     pub roles: Vec<String>,
+    /// The Engram Session node ID. Used by `EngramSessionStore` to validate
+    /// the session graph node on every request, enabling server-side logout.
+    pub session_id: Option<String>,
     pub iat: u64,      // issued-at (unix seconds)
     pub exp: u64,      // expiry (unix seconds)
 }
@@ -30,11 +37,24 @@ impl JwtClaims {
             email: user.email.clone(),
             name: user.name.clone(),
             roles,
+            session_id: None,
             iat: now,
             exp: now + ttl_seconds,
         }
     }
 
+    /// Create claims with an Engram session ID embedded.
+    pub fn new_with_session(
+        user: &AuthUser,
+        roles: Vec<String>,
+        session_id: impl Into<String>,
+        ttl_seconds: u64,
+    ) -> Self {
+        let mut claims = Self::new(user, roles, ttl_seconds);
+        claims.session_id = Some(session_id.into());
+        claims
+    }
+
     pub fn is_expired(&self) -> bool {
         unix_now() > self.exp
     }
@@ -47,10 +67,16 @@ impl JwtClaims {
             .map(|r| format!("\"{}\"", r))
             .collect::<Vec<_>>()
             .join(",");
-        format!(
-            "{{\"sub\":\"{}\",\"email\":\"{}\",\"name\":\"{}\",\"roles\":[{}],\"iat\":{},\"exp\":{}}}",
-            self.sub, self.email, self.name, roles_json, self.iat, self.exp
-        )
+        // Build the JSON manually, inserting session_id only when present.
+        let mut json = format!(
+            "{{\"sub\":\"{}\",\"email\":\"{}\",\"name\":\"{}\",\"roles\":[{}]",
+            self.sub, self.email, self.name, roles_json
+        );
+        if let Some(sid) = &self.session_id {
+            json.push_str(&format!(",\"session_id\":\"{}\"", sid));
+        }
+        json.push_str(&format!(",\"iat\":{},\"exp\":{}}}", self.iat, self.exp));
+        json
     }
 
     /// Deserialize claims from JSON (manual parser).
@@ -61,7 +87,8 @@ impl JwtClaims {
         let iat = extract_u64(json, "iat").unwrap_or(0);
         let exp = extract_u64(json, "exp").unwrap_or(0);
         let roles = extract_str_array(json, "roles");
-        Some(Self { sub, email, name, roles, iat, exp })
+        let session_id = extract_str(json, "session_id");
+        Some(Self { sub, email, name, roles, session_id, iat, exp })
     }
 }