Archived
Will Anderson
f4abfe6fdc
Belated rename commit for foundation/el-ui — was missed in the workspace-wide crates→vessels pass earlier today. Same structural intent as the rename in the other repos: 'crates' is the Rust word, 'vessel' is El's, and the directory rename is the marker that this slot holds an El buildable unit even if its current contents are still Rust pending port. Plus the El ports themselves — manifest.el + src/main.el per sub- vessel (el-aop, el-auth, el-config, el-i18n, el-identity, el-layout, el-platform, el-publish, el-secrets, el-services, el-style, el-ui- compiler). The ui-compiler is a stub: elc only emits C right now; generating browser-target JS/Wasm is the biggest open language gap and gets its own project. Until then, el-ui-compiler emits a JS module that throws elc.backend_missing so callers fail loudly. Cross-repo path dependencies in Cargo.toml updated to vessels/.
69 lines
1.9 KiB
Rust
69 lines
1.9 KiB
Rust
//! el-auth — Built-in authentication and authorization for el-ui.
|
|
//!
|
|
//! Not a library you add. Native to the framework.
|
|
//!
|
|
//! ```toml
|
|
//! [auth]
|
|
//! provider = "jwt"
|
|
//! jwt_secret_env = "JWT_SECRET"
|
|
//! session_store = "memory" # or "engram"
|
|
//! ```
|
|
//!
|
|
//! ## Engram-native sessions
|
|
//!
|
|
//! Use `EngramSessionStore` (in `engram_session`) for sessions backed by the
|
|
//! Engram identity graph. Sessions are graph nodes — server-side invalidation
|
|
//! works even with stateless JWTs.
|
|
|
|
pub mod context;
|
|
pub mod engram_session;
|
|
pub mod jwt;
|
|
pub mod middleware;
|
|
pub mod roles;
|
|
pub mod session;
|
|
|
|
pub use context::{AuthContext, AuthUser};
|
|
pub use engram_session::EngramSessionStore;
|
|
pub use jwt::{JwtClaims, JwtProvider};
|
|
pub use middleware::AuthMiddleware;
|
|
pub use roles::{Permission, Role, RoleRegistry};
|
|
pub use session::SessionProvider;
|
|
|
|
#[cfg(test)]
|
|
mod tests;
|
|
|
|
use thiserror::Error;
|
|
|
|
#[derive(Debug, Error)]
|
|
pub enum AuthError {
|
|
#[error("invalid credentials")]
|
|
InvalidCredentials,
|
|
#[error("token expired")]
|
|
TokenExpired,
|
|
#[error("token invalid: {0}")]
|
|
TokenInvalid(String),
|
|
#[error("session not found")]
|
|
SessionNotFound,
|
|
#[error("forbidden: requires permission '{0}'")]
|
|
Forbidden(String),
|
|
#[error("auth configuration error: {0}")]
|
|
Config(String),
|
|
}
|
|
|
|
pub type AuthResult<T> = Result<T, AuthError>;
|
|
|
|
/// The AuthProvider trait — implemented by JWT, Session, OAuth providers.
|
|
pub trait AuthProvider: Send + Sync {
|
|
/// The provider name (e.g., "jwt", "session").
|
|
fn name(&self) -> &'static str;
|
|
|
|
/// Verify a token/session string and return the auth context.
|
|
fn verify(&self, token: &str) -> AuthResult<AuthContext>;
|
|
|
|
/// Issue a new token/session for an authenticated user.
|
|
fn issue(&self, user: AuthUser, role_registry: &RoleRegistry) -> AuthResult<String>;
|
|
|
|
/// Revoke a token/session (for logout).
|
|
fn revoke(&self, token: &str) -> AuthResult<()>;
|
|
}
|