Struct TwoFactorPlugin 

pub struct TwoFactorPlugin { /* private fields */ }

Two-factor authentication plugin providing TOTP, OTP, and backup code flows.

Implementations

impl TwoFactorPlugin

pub fn callbacks<S: AuthSchema>( self, callbacks: TwoFactorCallbacks<S>, ) -> impl AuthPlugin<S>

Attach schema-aware callbacks after configuring the plugin options.

impl TwoFactorPlugin

pub fn new() -> Self

pub fn with_config(config: TwoFactorConfig) -> Self

pub fn allow_passwordless(self, val: bool) -> Self

pub fn totp_disabled(self, val: bool) -> Self

pub fn totp_allow_passwordless(self, val: bool) -> Self

pub fn otp_digits(self, val: usize) -> Self

pub fn otp_period(self, val: Duration) -> Self

pub fn otp_allowed_attempts(self, val: usize) -> Self

pub fn otp_storage(self, val: TwoFactorOtpStorage) -> Self

pub fn backup_code_options(self, val: BackupCodeOptions) -> Self

pub fn account_lockout(self, val: AccountLockout) -> Self

pub fn issuer(self, val: String) -> Self

pub fn skip_verification_on_enable(self, val: bool) -> Self

pub fn two_factor_cookie_max_age(self, val: f64) -> Self

pub fn trust_device_max_age(self, val: f64) -> Self

pub fn totp_period(self, val: f64) -> Self

pub fn totp_digits(self, val: usize) -> Self

impl TwoFactorPlugin

pub fn generate_totp(&self, secret: &str) -> AuthResult<String>

Generate a TOTP from a supplied secret in trusted server code.

pub fn custom_send_otp(self, sender: Arc<dyn SendTwoFactorOtp>) -> Self

Install a custom OTP sender.

pub async fn view_backup_codes<S: AuthSchema>( &self, user_id: &str, ctx: &AuthContext<S>, ) -> AuthResult<Vec<String>>

Read the currently stored backup codes for a user.

This is the Rust server-side equivalent of the TypeScript auth.api.viewBackupCodes capability. It is intentionally not exposed as a public HTTP route.

Trait Implementations

impl<S: AuthSchema> AuthPlugin<S> for TwoFactorPlugin

fn name(&self) -> &'static str

Plugin name - should be unique

fn after_request<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, response: &'life2 mut AuthResponse, ctx: &'life3 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait,

Inspect or extend the final route response after session cookies are applied.

fn routes(&self) -> Vec<AuthRoute>

Routes that this plugin handles

fn on_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each request - return Some(response) to handle, None to pass through

fn on_init<'life0, 'life1, 'async_trait>( &'life0 self, ctx: &'life1 mut AuthInitContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called when the plugin is initialized

fn telemetry_plugin_id(&self) -> Option<&'static str>

Return the upstream plugin ID; core option wrappers have no plugin ID.

fn openapi(&self) -> Result<OpenApiPluginMetadata, AuthError>

Document this configured plugin without invoking application field policies.

fn password_hasher(&self) -> Option<Arc<dyn PasswordHasher>>

Select the base password hasher before plugin initialization wraps it.

fn telemetry(&self, _options: &mut PluginTelemetry)

Report configured options without invoking callbacks or initializing the plugin.

fn rate_limits(&self) -> Result<Vec<PluginRateLimit>, AuthError>

Default endpoint limits, overridden by explicit application limits.

fn on_http_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect an HTTP request after rate limiting and before endpoint middleware. Native API calls do not run this hook. A response skips endpoint hooks.

fn on_http_response<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _response: &'life2 mut AuthResponse, _ctx: &'life3 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, Self: 'async_trait,

Inspect the HTTP router response, including route misses and body errors. Early HTTP request responses and native endpoint calls skip this hook. A replacement response stops the remaining HTTP response hooks.

fn before_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<BeforeRequestAction>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called for a registered endpoint after HTTP body decoding and origin checks.

impl Clone for TwoFactorPlugin

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for TwoFactorPlugin

fn default() -> Self

Returns the “default value” for a type.