Module auth 

Structs

AuthConfig

Constants

COOKIE_NAME

Cookie name holding the JWT.

MFA_OK

Session is fully authenticated (second factor satisfied, or none required).

MFA_PENDING

Password verified, but a second factor is still required before access.

Functions

build_ctx

Build a request context, verifying the auth cookie into claims if present and carrying the raw CSRF cookie through for crate::csrf to check.

configure

Enable authentication globally. Until this is called, auth is disabled and every resource is publicly accessible (convenient for quick starts / tests).

create_admin

Convenience for seeding: insert an admin user (bcrypt-hashing the password).

guard_ui

UI guard for the dashboard and other non-resource pages: Some(redirect) when auth is configured and the visitor is unauthenticated or MFA-pending.

handle_login

Validate credentials against the admin table and, on success, redirect to the dashboard with the auth cookie set. csrf is the submitted hidden field; it must match the CSRF cookie or the post is rejected before any lookup.

handle_logout

Clear the auth cookie and return to the login page. Logout is client-side: it removes the browser’s cookie but cannot invalidate a token already copied elsewhere — that token remains valid until it expires (token_ttl_secs). To force-revoke sessions, rotate jwt_secret (kills all) or wait out a short TTL.

handle_mfa_enable

Confirm the code, enable MFA, generate backup codes, and show them once.

handle_mfa_verify

Verify a TOTP or one-time backup code and, on success, upgrade the session.

hash_password

is_authorized

True if the principal in ctx holds at least one of allowed_roles and has cleared MFA. Always true when auth is not configured.

is_configured

issue_token

Issue a signed JWT for a principal at the given MFA step (MFA_OK or MFA_PENDING). Returns None if auth isn’t configured.

login_page

Render the login page (optionally with an error message).

login_redirect

Redirect a blocked UI visitor to the right place: the MFA challenge when a second factor is still pending, otherwise the login page.

mfa_setup_page

Setup page: shows a QR + secret and asks the user to confirm a code to enable MFA. Skippable — the “Skip for now” link just goes back to the dashboard.

mfa_verify_page

Challenge page for an MFA-enabled user mid-login.

verify_password

verify_token

Verify a JWT and return the principal, or None if invalid/expired/unconfigured.