Module auth 

Authentication

Authentication and encryption library for the Chronix time-series database.

Features

• API key authentication — Argon2-hashed keys with optional expiry
• JWT/OIDC authentication — RS256/HS256 token validation with configurable claims
• mTLS authentication — Client certificate identity extraction
• Encryption at rest — AES-256-GCM authenticated encryption with key rotation
• Unified auth context — Common AuthContext across all methods

Architecture

Request → AuthMiddleware → [mTLS → JWT → API Key] → AuthContext
                                                      ├── principal
                                                      ├── method
                                                      └── claims

Re-exports

pub use api_key::ApiKeyStore;

pub use encryption::EncryptionService;

pub use encryption::KeyProvider;

pub use encryption::SecretKey;

pub use error::AuthError;

pub use jwt::JwtValidator;

pub use middleware::AuthContext;

pub use middleware::AuthMethod;

pub use middleware::AuthMiddleware;

pub use mtls::MtlsValidator;

pub use oidc::CachedKey;

pub use oidc::JwksCache;

pub use rotation::RotatingKeyProvider;

pub use rotation::RotationEvent;

pub use rotation::RotationPolicy;

pub use rotation::RotationReason;

Modules

api_key

API key authentication with Argon2 password hashing.

encryption

AES-256-GCM authenticated encryption for data at rest.

error

Authentication errors.

jwt

JWT and OIDC token validation.

middleware

Unified authentication middleware.

mtls

mTLS client certificate authentication.

oidc

OIDC discovery and JWKS caching.

rotation

Automated secret rotation for encryption keys.