Module auth 

Auth: sessions, guards, policies. Argon2-backed.

Structs

ApiGuard

Auth

The Auth<U> extractor. On every request, looks up the session, reads the stored user ID, and loads the user via U::find_by_id. Returns 401 if there’s no session, no user_id, or no matching user.

AuthManager

Manager-level auth state. Currently holds a hashing pepper toggle; future expansion: multiple guards, OAuth providers, etc.

Guarded

OptionalAuth

Optional version of Auth<U> — returns None instead of 401 when the user isn’t authenticated. Useful for routes that customize their response based on auth state (e.g., a home page that shows “Login” vs the user’s name).

WebGuard

Phantom guard markers. The current Auth<U> extractor is session-only; these are reserved so v0.2 can add bearer-token guards via type parameter.

Constants

SESSION_USER_ID_KEY

Traits

Authenticatable

Marker trait for app-defined user models that participate in auth.

Guard

Policy

Policy trait: implementations decide whether user can perform ability on subject.

Functions

attempt

Run a credentials-based login attempt. Returns the authenticated user or None if credentials are invalid. Does NOT persist the login — call login to write the user ID into the session.

authorize

Convenience: ability-check shorthand. Returns Error::Forbidden on failure.

hash_password

Hash a password using argon2id. Returns the encoded PHC string.

login

Persist a user as authenticated for the current session.

logout

Clear the authenticated user from the session.

verify_password

Verify a plaintext password against an encoded PHC string.