add el-identity: Engram-native identity, OAuth, @authenticate by default

crates/el-aop/src/chain.rs

@@ -9,8 +9,13 @@
 //!                                 hit? ──→ return cached
 //!                                 miss? → [method body] → store → after-log
 //! ```
+//!
+//! ## Security-by-default
+//!
+//! `AspectChain::with_default_auth()` prepends `AuthenticateAspect` to every
+//! chain. Call this when building chains for non-`@public` functions.
 
-use crate::{AopResult, Aspect, InvocationContext, InvocationResult, ProceedFn};
+use crate::{aspects::AuthenticateAspect, AopResult, Aspect, InvocationContext, InvocationResult, ProceedFn};
 use std::sync::Arc;
 
 /// An ordered chain of aspects applied to a single method.
@@ -90,6 +95,24 @@ impl AspectChain {
     pub fn aspect_names(&self) -> Vec<&str> {
         self.aspects.iter().map(|a| a.name()).collect()
     }
+
+    /// Prepend `AuthenticateAspect` to this chain.
+    ///
+    /// This is the mechanism for security-by-default: the framework calls
+    /// `with_default_auth()` on every chain that does NOT have `@public`.
+    ///
+    /// Equivalent to `.add(Arc::new(AuthenticateAspect))` at position 0, but
+    /// semantically explicit about what it means.
+    pub fn with_default_auth(self) -> Self {
+        let mut aspects = vec![Arc::new(AuthenticateAspect) as Arc<dyn Aspect>];
+        aspects.extend(self.aspects);
+        Self { aspects }
+    }
+
+    /// Returns `true` if the chain contains an `AuthenticateAspect`.
+    pub fn has_auth(&self) -> bool {
+        self.aspects.iter().any(|a| a.name() == "authenticate")
+    }
 }
 
 impl Default for AspectChain {

crates/el-aop/src/lib.rs

@@ -4,12 +4,20 @@
 //! import. Built into the framework. Applied as decorators:
 //!
 //! ```text
-//! @authenticate
+//! @authenticate          ← applied by DEFAULT to every function
 //! @authorize(role: "admin")
 //! @cache(ttl: 300)
 //! @rate_limit(requests: 100, per: 60)
 //! component AdminDashboard { ... }
+//!
+//! @public                ← explicit opt-out of authentication
+//! component LandingPage { ... }
 //! ```
+//!
+//! ## Security-by-default
+//!
+//! `@authenticate` is the default. Functions without `@public` are protected.
+//! This makes it as hard as possible to accidentally ship an unprotected endpoint.
 
 pub mod aspects;
 pub mod chain;
@@ -20,8 +28,11 @@ pub use aspects::{
     TraceAspect, ValidateAspect,
 };
 pub use chain::AspectChain;
+pub use public::PublicMarker;
 pub use registry::AspectRegistry;
 
+pub mod public;
+
 #[cfg(test)]
 mod tests;
 

crates/el-aop/src/public.rs

@@ -0,0 +1,57 @@
+//! `@public` marker — the explicit opt-out of authentication.
+//!
+//! The security-by-default model: `@authenticate` is applied to EVERY function
+//! by default. `@public` is the rare annotation that says "this endpoint
+//! intentionally has no auth".
+//!
+//! `PublicMarker` is a zero-cost marker. When the compiler sees `@public` on a
+//! function, it strips `AuthenticateAspect` from the chain for that function.
+//! The chain-builder checks `is_public` before prepending default auth.
+
+/// Zero-cost marker indicating that a function is intentionally public.
+///
+/// When `@public` is present, the default `AuthenticateAspect` is NOT added
+/// to the function's aspect chain.
+///
+/// Usage in the el-ui compiler:
+/// ```text
+/// @public
+/// fn health_check() -> Status { ... }
+/// ```
+///
+/// In the AOP chain builder:
+/// ```rust
+/// use el_aop::{AspectChain, PublicMarker, AuthenticateAspect};
+/// use std::sync::Arc;
+///
+/// fn build_chain(is_public: bool) -> AspectChain {
+///     if is_public || PublicMarker::is_bypassing() {
+///         AspectChain::new()
+///     } else {
+///         AspectChain::new().with_default_auth()
+///     }
+/// }
+/// ```
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub struct PublicMarker;
+
+impl PublicMarker {
+    /// Returns `true` — always. Exists for use in match arms / conditional logic.
+    ///
+    /// The presence of a `PublicMarker` in the decorator list is the signal;
+    /// this method is a convenience for procedural logic over decorator lists.
+    pub const fn is_bypassing() -> bool {
+        true
+    }
+
+    /// The decorator name this marker corresponds to.
+    pub const fn decorator_name() -> &'static str {
+        "public"
+    }
+}
+
+impl std::fmt::Display for PublicMarker {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "@public")
+    }
+}

crates/el-aop/src/registry.rs

@@ -2,6 +2,14 @@
 //!
 //! The compiler's AOP codegen uses the registry to look up aspect implementations
 //! by their decorator name (e.g., `"authenticate"` → `AuthenticateAspect`).
+//!
+//! ## Security-by-default
+//!
+//! `"public"` is a special bypass marker — NOT an aspect. When the compiler sees
+//! `@public` it calls `registry.is_public_bypass(name)` and skips default auth.
+//!
+//! `set_default_auth_guard()` installs the global default `AuthenticateAspect`
+//! that is prepended to every non-`@public` chain.
 
 use crate::Aspect;
 use std::collections::HashMap;
@@ -12,12 +20,21 @@ type AspectFactory = Box<dyn Fn(&HashMap<String, String>) -> Arc<dyn Aspect> + S
 /// Registry of aspect factories, indexed by decorator name.
 pub struct AspectRegistry {
     factories: RwLock<HashMap<String, AspectFactory>>,
+    /// When `true`, the registry is configured to prepend AuthenticateAspect
+    /// to every non-`@public` chain via `AspectChain::with_default_auth()`.
+    default_auth_enabled: RwLock<bool>,
+    /// Names that are bypass markers (not real aspects). Currently just "public".
+    bypass_markers: RwLock<std::collections::HashSet<String>>,
 }
 
 impl AspectRegistry {
     pub fn new() -> Self {
+        let mut markers = std::collections::HashSet::new();
+        markers.insert("public".to_string());
         Self {
             factories: RwLock::new(HashMap::new()),
+            default_auth_enabled: RwLock::new(false),
+            bypass_markers: RwLock::new(markers),
         }
     }
 
@@ -28,6 +45,71 @@ impl AspectRegistry {
         registry
     }
 
+    /// Enable security-by-default: every non-`@public` chain will have
+    /// `AuthenticateAspect` prepended automatically.
+    ///
+    /// Call at application startup. After this, use `AspectChain::with_default_auth()`
+    /// when building chains for protected functions.
+    pub fn set_default_auth_enabled(&self, enabled: bool) {
+        *self.default_auth_enabled.write().expect("registry lock poisoned") = enabled;
+    }
+
+    /// Returns `true` if security-by-default auth is active.
+    pub fn is_default_auth_enabled(&self) -> bool {
+        *self.default_auth_enabled.read().expect("registry lock poisoned")
+    }
+
+    /// Returns `true` if `name` is a public bypass marker (e.g., `"public"`).
+    ///
+    /// Bypass markers are NOT aspects — they signal that default auth should
+    /// be skipped for the decorated function.
+    pub fn is_public_bypass(&self, name: &str) -> bool {
+        self.bypass_markers
+            .read()
+            .expect("registry lock poisoned")
+            .contains(name)
+    }
+
+    /// Register a custom bypass marker name.
+    ///
+    /// By default only `"public"` is registered. Use this to add custom
+    /// bypass annotations (e.g., `"internal_only"` that uses a different guard).
+    pub fn register_bypass_marker(&self, name: &str) {
+        self.bypass_markers
+            .write()
+            .expect("registry lock poisoned")
+            .insert(name.to_string());
+    }
+
+    /// Build an `AspectChain` for a function with the given decorators.
+    ///
+    /// This is the primary chain-building entry point used by the AOP codegen.
+    ///
+    /// - If any decorator is a bypass marker (`@public`), returns a plain chain
+    ///   with no default auth.
+    /// - Otherwise, if `default_auth_enabled`, prepends `AuthenticateAspect`.
+    /// - Unknown decorator names are silently skipped (forward-compatible).
+    pub fn build_chain(&self, decorator_names: &[(&str, HashMap<String, String>)]) -> crate::AspectChain {
+        let is_public = decorator_names.iter().any(|(name, _)| self.is_public_bypass(name));
+
+        let mut chain = crate::AspectChain::new();
+
+        for (name, params) in decorator_names {
+            if self.is_public_bypass(name) {
+                continue; // bypass markers are not aspects
+            }
+            if let Some(aspect) = self.create(name, params) {
+                chain = chain.add(aspect);
+            }
+        }
+
+        if !is_public && self.is_default_auth_enabled() {
+            chain = chain.with_default_auth();
+        }
+
+        chain
+    }
+
     /// Register all built-in aspects.
     pub fn register_builtins(&self) {
         use crate::aspects::*;
@@ -147,3 +229,56 @@ impl Default for AspectRegistry {
         Self::new()
     }
 }
+
+#[cfg(test)]
+mod registry_default_auth_tests {
+    use super::*;
+
+    #[test]
+    fn test_default_auth_disabled_by_default() {
+        let reg = AspectRegistry::new();
+        assert!(!reg.is_default_auth_enabled());
+    }
+
+    #[test]
+    fn test_set_default_auth_enabled() {
+        let reg = AspectRegistry::new();
+        reg.set_default_auth_enabled(true);
+        assert!(reg.is_default_auth_enabled());
+    }
+
+    #[test]
+    fn test_public_is_bypass_marker() {
+        let reg = AspectRegistry::new();
+        assert!(reg.is_public_bypass("public"));
+        assert!(!reg.is_public_bypass("authenticate"));
+    }
+
+    #[test]
+    fn test_build_chain_public_skips_default_auth() {
+        let reg = AspectRegistry::with_builtins();
+        reg.set_default_auth_enabled(true);
+        let decorators = vec![("public", HashMap::new())];
+        let chain = reg.build_chain(&decorators);
+        assert!(!chain.has_auth(), "public chain should not have default auth");
+    }
+
+    #[test]
+    fn test_build_chain_non_public_gets_default_auth() {
+        let reg = AspectRegistry::with_builtins();
+        reg.set_default_auth_enabled(true);
+        let decorators = vec![("log", HashMap::new())];
+        let chain = reg.build_chain(&decorators);
+        assert!(chain.has_auth(), "non-public chain should have default auth prepended");
+    }
+
+    #[test]
+    fn test_build_chain_auth_is_first_aspect() {
+        let reg = AspectRegistry::with_builtins();
+        reg.set_default_auth_enabled(true);
+        let decorators = vec![("log", HashMap::new())];
+        let chain = reg.build_chain(&decorators);
+        let names = chain.aspect_names();
+        assert_eq!(names[0], "authenticate", "authenticate must be first in the chain");
+    }
+}