acme_proxy/admin/
mod.rs

1//! Administrative operations, shared by both front ends and owned by neither.
2//!
3//! [`crate::cli`] and [`crate::webadmin`] are the two front ends; everything
4//! they can do lives here, so the password policy, the duplicate check and the
5//! rehash-on-login cannot drift between a terminal and a browser.
6//!
7//! - [`ops`] — the operations themselves (accounts, orders, EAB, nonces, audit).
8//! - [`render`] — one JSON renderer per shape, surfacing the admin-only fields
9//!   (an order's revocation, an account's traceability columns) the ACME wire
10//!   format deliberately does not carry. **JSON only**: both front ends parse
11//!   these, so they are a wire format. The human-readable renderings have
12//!   exactly one consumer and live in [`crate::cli::render`], which is where
13//!   colour is woven in — and therefore cannot reach a `--json` shape.
14//! - [`password`], [`users`] — the credential store and the KDF.
15//! - [`totp`], [`recovery`], [`mfa`] — the second factor: RFC 6238 over RFC 4226,
16//!   single-use recovery codes, and where those two meet the database.
17//! - [`prompt`] — confirmation, over an injectable reader so it is testable.
18//!
19//! **Destructive operations come in pairs**: a bare form, and a `confirm_*`
20//! wrapper taking `assume_yes` and a reader. Those two arguments are a
21//! terminal's concern, so the CLI calls the wrapper and the web calls the bare
22//! form — rather than an HTTP caller passing `true` and an empty reader to
23//! assert a confirmation that never happened.
24
25pub mod mfa;
26pub mod ops;
27pub mod password;
28pub mod prompt;
29pub mod recovery;
30pub mod render;
31pub mod totp;
32pub mod users;
33
34pub use ops::*;
35pub use prompt::*;
36pub use render::*;
37
38// `password`, `totp`, `recovery` and `users` are deliberately *not* re-exported
39// flat. The three modules above hold one vocabulary between them, but
40// `admin::password::verify` and `admin::users::create_user` read as what they
41// are only with the module name attached -- a bare `admin::authenticate` says
42// nothing about who, and a bare `admin::verify` says nothing about what.
acme_proxy/admin/mod.rs

acme_proxy/admin/
mod.rs
