Crate chronon_axum 

Axum HTTP API for Chronon (/api/chronon/*).

Mounts job, run, and script routes on a host Axum server. Handlers delegate to chronon_runtime::CoordinatorService and read script metadata from chronon_executor::ScriptRegistry.

Features

• AdminAuth — host-supplied AdminAuth via ChrononStateBuilder; lab helpers StaticTokenAdminAuth / AllowAllAdminAuth. Production identity belongs to Higgs.
• CHRONON_REQUIRE_ADMIN_AUTH — when set, ChrononStateBuilder::build and RequireAdmin fail closed without a verifier.
• External actor policy — HTTP upsert rejects System-shaped actor_json (RejectExternalSystemActor).
• Error hygiene — HTTP envelopes sanitize/redact credentials in error strings.

Security

Wrap-before-public-bind: nest under API_PREFIX, install AdminAuth (or host middleware), and set CHRONON_REQUIRE_ADMIN_AUTH=1 before exposing the API. See repository SECURITY.md and the axum_auth_wrap example.

Routes

• GET/POST /jobs/* — list, upsert (by job_name), pause, resume, run now
• GET /runs/* — list (limit capped at 1000) and fetch runs
• GET /scripts — list registered scripts
• GET /jobs/{id}/revisions — revision metadata with actor/params redacted

All responses use the ApiResponse envelope (success, data, error). UpsertJobRequest::script_name must exist in the registry or upsert returns 400. Concurrency, timeout, and retry knobs are clamped to production ceilings.

Remote HTTP clients

Mount this router on an embedded or coordinator–worker host behind host auth, then point chronon_runtime::RemoteCoordinatorClient at {base_url} (paths under API_PREFIX). See the chronon crate Remote HTTP client section.

Examples

Completed setup with RequireAdmin / StaticTokenAdminAuth:

use std::sync::Arc;
use axum::extract::FromRef;
use axum::Router;
use chronon_axum::{
    chronon_router, ChrononState, StaticTokenAdminAuth, API_PREFIX,
};
use chronon_backend_mem::InMemorySchedulerStore;
use chronon_core::{Result as ChrononResult, ScriptContext};
use chronon_executor::{ScriptDescriptor, ScriptRegistry};
use chronon_runtime::CoordinatorService;

fn noop(
    _ctx: Box<dyn ScriptContext>,
    _params: serde_json::Value,
) -> std::pin::Pin<Box<dyn std::future::Future<Output = ChrononResult<()>> + Send>> {
    Box::pin(async { Ok(()) })
}

#[derive(Clone)]
struct AppState {
    chronon: ChrononState,
}

impl FromRef<AppState> for ChrononState {
    fn from_ref(state: &AppState) -> Self {
        state.chronon.clone()
    }
}

let store = Arc::new(InMemorySchedulerStore::new());
let coordinator = Arc::new(CoordinatorService::new(store));
let registry = Arc::new({
    let mut r = ScriptRegistry::new();
    r.register(&ScriptDescriptor::new("demo", noop));
    r
});
let chronon = ChrononState::builder(coordinator, registry)
    .admin_auth(Arc::new(StaticTokenAdminAuth::new("lab-token")))
    .require_admin_auth(true)
    .build()?;
Ok(Router::new()
    .nest(API_PREFIX, chronon_router::<AppState>())
    .with_state(AppState { chronon }))

Runnable: cargo run -p uf-chronon --example axum_host --features mem,axum, axum_auth_wrap, and remote_http_client (client against a nested router).

Structs

AdminAuthError

Rejection from AdminAuth::authorize.

AllowAllAdminAuth

Shared always-allow verifier for local tests (not for production).

ApiResponse

Standard API wrapper: success, optional data, optional error.

ChrononState

Shared state for Chronon API handlers.

ChrononStateBuilder

Build ChrononState with admin auth and actor overrides.

JobActionRequest

Body for job actions: pause, resume, and run-now.

JobResponse

Job summary returned by list/get/upsert endpoints.

ListJobsQuery

Query params for GET /jobs.

ListRunsQuery

Query params for GET /runs.

RequireAdmin

Extractor that enforces ChrononState::admin_auth / require-flag before the handler runs.

RunResponse

Run summary for list/get run endpoints.

ScriptResponse

Registered script metadata from GET /scripts.

StaticTokenAdminAuth

Header-based verifier: require x-chronon-admin-token equal to the configured secret.

UpsertJobRequest

Body for POST /jobs/upsert.

Enums

ScheduleKindDto

Wire format for ScheduleKind in JSON (snake_case).

Constants

API_PREFIX

API mount prefix for host routers (e.g. nest(API_PREFIX, chronon_router())).

REQUIRE_ADMIN_AUTH_ENV

Environment variable: when 1/true/yes, admin routes require a configured AdminAuth.

Traits

AdminAuth

Host-supplied verifier for Chronon admin HTTP.

Functions

chronon_router

Create the Chronon API router with job, run, and script routes.

require_admin_auth_from_env

Read REQUIRE_ADMIN_AUTH_ENV: 1, true, or yes (case-insensitive) ⇒ required.

Type Aliases

HttpUpsertActorProvider

Callback that supplies actor_json when HTTP upsert omits a client actor.