Struct AllowThem 

pub struct AllowThem { /* private fields */ }

Configured allowthem handle.

Bundles a Db, SessionConfig, and cookie domain into a single value that is cheaply cloneable and safe to share across Axum handlers via State<AllowThem> or Extension<AllowThem>.

Implementations

impl AllowThem

pub fn db(&self) -> &Db

Access the underlying database handle.

Escape hatch for callers who need direct Db access for operations not yet wrapped by AllowThem methods (e.g., user CRUD, role management).

pub fn session_config(&self) -> &SessionConfig

Access the session configuration.

pub fn session_cookie(&self, token: &SessionToken) -> String

Build a Set-Cookie header value for the given session token.

Uses the stored SessionConfig and cookie domain. Delegates to sessions::session_cookie().

pub fn base_url(&self) -> Result<&str, AuthError>

Returns the base URL (issuer), or Err(BaseUrlNotConfigured) if not set.

pub fn csrf_key(&self) -> Result<&[u8; 32], AuthError>

pub async fn get_decrypted_signing_key( &self, ) -> Result<(SigningKey, String), AuthError>

Fetch the active signing key and decrypt its private key PEM.

Combines the encryption key, active key lookup, and decryption into a single call. Keeps the raw encryption key private to the core crate.

pub fn clear_session_cookie(&self) -> String

Build a Set-Cookie header value that expires the session cookie.

Returns Max-Age=0 with the same cookie name, path, domain, and flags used by session_cookie(). Pass this as the Set-Cookie header on a logout response to clear the browser’s stored session cookie.

pub fn parse_session_cookie(&self, cookie_header: &str) -> Option<SessionToken>

Extract the session token from a Cookie header value.

Uses the stored cookie name. Delegates to sessions::parse_session_cookie().

pub async fn login( &self, identifier: &str, password: &str, ) -> Result<LoginOutcome, AuthError>

Authenticate with credentials and create a session.

Returns Err(AuthError::InvalidCredentials) for any credential failure — unknown identifier, wrong password, no local password hash (SSO-only account), or inactive user — to prevent account enumeration.

Records an AuditEvent::Login on success. IP and user-agent are not available at this layer; callers who need them in the audit log should use the low-level Db methods directly.

pub async fn create_session_cookie( &self, user_id: UserId, ) -> Result<LoginOutcome, AuthError>

Create a session for an already-authenticated user.

Does not verify credentials. Intended for use after OAuth, TOTP, or other non-password authentication flows. The calling flow is responsible for audit logging.

impl AllowThem

pub async fn get_pending_mfa_secret( &self, user_id: UserId, ) -> Result<Option<String>, AuthError>

pub async fn create_mfa_secret( &self, user_id: UserId, ) -> Result<String, AuthError>

pub async fn enable_mfa( &self, user_id: UserId, code: &str, ) -> Result<Vec<String>, AuthError>

pub async fn verify_totp( &self, user_id: UserId, code: &str, ) -> Result<bool, AuthError>

pub async fn has_mfa_enabled(&self, user_id: UserId) -> Result<bool, AuthError>

pub async fn disable_mfa(&self, user_id: UserId) -> Result<(), AuthError>

pub async fn verify_recovery_code( &self, user_id: UserId, code: &str, ) -> Result<bool, AuthError>

pub async fn remaining_recovery_codes( &self, user_id: UserId, ) -> Result<i64, AuthError>

pub async fn regenerate_recovery_codes( &self, user_id: UserId, ) -> Result<Vec<String>, AuthError>

Trait Implementations

impl Clone for AllowThem

fn clone(&self) -> AllowThem

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.