Skip to main content Module auth Copy item path Source AuthConfig COOKIE_NAME Cookie name holding the JWT. MFA_OK Session is fully authenticated (second factor satisfied, or none required). MFA_PENDING Password verified, but a second factor is still required before access. build_ctx Build a request context, verifying the auth cookie into claims if present
and carrying the raw CSRF cookie through for crate::csrf to check. configure Enable authentication globally. Until this is called, auth is disabled and
every resource is publicly accessible (convenient for quick starts / tests). create_admin Convenience for seeding: insert an admin user (bcrypt-hashing the password). guard_ui UI guard for the dashboard and other non-resource pages: Some(redirect)
when auth is configured and the visitor is unauthenticated or MFA-pending. handle_login Validate credentials against the admin table and, on success, redirect to the
dashboard with the auth cookie set. csrf is the submitted hidden field; it
must match the CSRF cookie or the post is rejected before any lookup. handle_logout Clear the auth cookie and return to the login page. handle_mfa_enable Confirm the code, enable MFA, generate backup codes, and show them once. handle_mfa_verify Verify a TOTP or one-time backup code and, on success, upgrade the session. hash_password is_authorized True if the principal in ctx holds at least one of allowed_roles and has
cleared MFA. Always true when auth is not configured. is_configured issue_token Issue a signed JWT for a principal at the given MFA step (MFA_OK or
MFA_PENDING). Returns None if auth isn’t configured. login_page Render the login page (optionally with an error message). login_redirect Redirect a blocked UI visitor to the right place: the MFA challenge when a
second factor is still pending, otherwise the login page. mfa_setup_page Setup page: shows a QR + secret and asks the user to confirm a code to enable
MFA. Skippable — the “Skip for now” link just goes back to the dashboard. mfa_verify_page Challenge page for an MFA-enabled user mid-login. verify_password verify_token Verify a JWT and return the principal, or None if invalid/expired/unconfigured.