Will Anderson
69 lines
1.9 KiB
Rust
69 lines
1.9 KiB
Rust
//! el-auth — Built-in authentication and authorization for el-ui.
|
|
//!
|
|
//! Not a library you add. Native to the framework.
|
|
//!
|
|
//! ```toml
|
|
//! [auth]
|
|
//! provider = "jwt"
|
|
//! jwt_secret_env = "JWT_SECRET"
|
|
//! session_store = "memory" # or "engram"
|
|
//! ```
|
|
//!
|
|
//! ## Engram-native sessions
|
|
//!
|
|
//! Use `EngramSessionStore` (in `engram_session`) for sessions backed by the
|
|
//! Engram identity graph. Sessions are graph nodes — server-side invalidation
|
|
//! works even with stateless JWTs.
|
|
|
|
pub mod context;
|
|
pub mod engram_session;
|
|
pub mod jwt;
|
|
pub mod middleware;
|
|
pub mod roles;
|
|
pub mod session;
|
|
|
|
pub use context::{AuthContext, AuthUser};
|
|
pub use engram_session::EngramSessionStore;
|
|
pub use jwt::{JwtClaims, JwtProvider};
|
|
pub use middleware::AuthMiddleware;
|
|
pub use roles::{Permission, Role, RoleRegistry};
|
|
pub use session::SessionProvider;
|
|
|
|
#[cfg(test)]
|
|
mod tests;
|
|
|
|
use thiserror::Error;
|
|
|
|
#[derive(Debug, Error)]
|
|
pub enum AuthError {
|
|
#[error("invalid credentials")]
|
|
InvalidCredentials,
|
|
#[error("token expired")]
|
|
TokenExpired,
|
|
#[error("token invalid: {0}")]
|
|
TokenInvalid(String),
|
|
#[error("session not found")]
|
|
SessionNotFound,
|
|
#[error("forbidden: requires permission '{0}'")]
|
|
Forbidden(String),
|
|
#[error("auth configuration error: {0}")]
|
|
Config(String),
|
|
}
|
|
|
|
pub type AuthResult<T> = Result<T, AuthError>;
|
|
|
|
/// The AuthProvider trait — implemented by JWT, Session, OAuth providers.
|
|
pub trait AuthProvider: Send + Sync {
|
|
/// The provider name (e.g., "jwt", "session").
|
|
fn name(&self) -> &'static str;
|
|
|
|
/// Verify a token/session string and return the auth context.
|
|
fn verify(&self, token: &str) -> AuthResult<AuthContext>;
|
|
|
|
/// Issue a new token/session for an authenticated user.
|
|
fn issue(&self, user: AuthUser, role_registry: &RoleRegistry) -> AuthResult<String>;
|
|
|
|
/// Revoke a token/session (for logout).
|
|
fn revoke(&self, token: &str) -> AuthResult<()>;
|
|
}
|