Struct Authenticator 

pub struct Authenticator { /* private fields */ }

Issues and verifies credentials for one running server.

Implementations

impl Authenticator

pub fn new(secret: impl Into<Vec<u8>>, session_ttl_secs: u64) -> Self

pub fn hash_password(&self, plaintext: &str) -> Result<String, Error>

Hash a plaintext password with argon2id (random salt).

pub fn hash_password_with_argon2(plaintext: &str) -> Result<String, Error>

The same hash, without an authenticator to hold.

Passwords are salted per hash and never touch the JWT secret, so this needs no instance — which is what lets a fixture loaded before the server exists (seed/user.toml) write a password somebody can sign in with.

pub fn verify_password(&self, plaintext: &str, hash: &str) -> bool

Verify a plaintext password against a stored argon2 hash.

pub fn issue_token(&self, user_id: Uuid) -> Result<String, Error>

Mint a signed session JWT for a user id.

pub fn verify_token(&self, token: &str) -> Result<Uuid, Error>

Verify a session JWT and recover the user id it was issued for.

pub fn generate_api_key(&self) -> (String, String)

Generate a new API key: (plaintext, sha256_hex). The plaintext is shown to the user once; only the hash is stored.

pub fn hash_api_key(plaintext: &str) -> String

Deterministic hash used to look an API key up. SHA-256 (not argon2) so a single indexed equality lookup resolves the key.

pub fn generate_link_token(prefix: &str) -> (String, String)

Generate a single-use token for a link sent to somebody’s mailbox — an invitation, an address confirmation, a password reset — as (plaintext, sha256_hex).

The plaintext goes in the message and is never stored; the hash is what the row holds, so the database alone yields no working link. prefix is cosmetic (inv, verify, reset) and only makes a token in a log or a support ticket identifiable at a glance.

The same 256 bits of entropy an API key gets: these are bearer credentials that create accounts and change passwords, so a shorter token guessable in bulk would be the weakest thing in the system.

pub fn hash_link_token(plaintext: &str) -> String

The hash a generate_link_token token is stored and looked up by.

Trait Implementations

impl Clone for Authenticator

fn clone(&self) -> Authenticator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.