Struct AdminPlugin 

pub struct AdminPlugin { /* private fields */ }

Admin plugin for user management operations.

Implementations

impl AdminPlugin

pub fn get_user_endpoint( id: impl Into<String>, ) -> ServerEndpoint<AdminUserOutput>

Read a user through the installed admin policy and server endpoint hooks.

pub fn set_role_endpoint( body: &AdminSetRoleRequest, ) -> AuthResult<ServerEndpoint<AdminUserResponse>>

Assign literal roles through installed server policy and hooks.

pub fn create_user_endpoint( body: &AdminCreateUserRequest, ) -> AuthResult<ServerEndpoint<AdminUserResponse>>

Provision a user through installed server policy and hooks. Without a Request or headers, the call is trusted; supplying either requires a session.

pub fn user_has_permission_endpoint( body: &AdminPermissionRequest, ) -> AuthResult<ServerEndpoint<AdminPermissionResponse>>

Evaluate permissions through the installed admin policy and server hooks. Trusted selectors apply only without a Request or headers; a session always wins.

pub fn admin_update_user_endpoint( body: &AdminUpdateUserRequest, ) -> AuthResult<ServerEndpoint<AdminUserOutput>>

Update a user through authoritative admin policy and installed server hooks.

pub fn list_users_endpoint( query: &AdminListUsersQuery, ) -> AuthResult<ServerEndpoint<AdminListUsersResponse>>

List users through authoritative admin policy and installed server hooks.

pub fn list_user_sessions_endpoint( user_id: impl Into<String>, ) -> ServerEndpoint<AdminUserSessionsResponse>

List a user’s stored sessions through authoritative admin policy and server hooks.

pub fn stop_impersonating_endpoint() -> ServerEndpoint<AdminImpersonationResponse>

Restore the original session from a signed impersonation cookie.

pub fn impersonate_user_endpoint( user_id: impl Into<String>, ) -> ServerEndpoint<AdminImpersonationResponse>

Create an impersonation session and publish cookies through authoritative admin policy.

pub fn set_user_password_endpoint( input: &AdminSetUserPasswordRequest, ) -> AuthResult<ServerEndpoint<StatusResponse>>

Replace or create a credential through authoritative admin policy and server hooks.

Errors

Returns an error if the logical input cannot be serialized.

pub fn remove_user_endpoint( user_id: impl Into<String>, ) -> ServerEndpoint<AdminSuccessResponse>

Remove a stored user, their accounts and sessions through authoritative admin policy.

pub fn revoke_user_sessions_endpoint( user_id: impl Into<String>, ) -> ServerEndpoint<AdminSuccessResponse>

Revoke all stored sessions for a user through authoritative administrative policy.

pub fn revoke_user_session_endpoint( session_token: impl Into<String>, ) -> ServerEndpoint<AdminSuccessResponse>

Revoke one stored session token through authoritative administrative policy.

pub fn ban_user_endpoint( input: &AdminBanUserRequest, ) -> AuthResult<ServerEndpoint<AdminUserResponse>>

Ban a stored user and revoke their sessions through authoritative admin policy.

Errors

Returns an error if the logical input cannot be serialized.

pub fn unban_user_endpoint( user_id: impl Into<String>, ) -> ServerEndpoint<AdminUserResponse>

Clear a stored user’s ban through authoritative admin policy and server hooks.

impl AdminPlugin

pub fn new() -> Self

pub fn with_config(config: AdminConfig) -> Self

pub fn default_role(self, val: impl Into<String>) -> Self

pub fn admin_roles(self, val: Vec<String>) -> Self

pub fn admin_user_ids(self, val: Vec<String>) -> Self

pub fn roles(self, val: HashMap<String, RolePermissions>) -> Self

pub fn default_ban_reason(self, val: String) -> Self

pub fn default_ban_expires_in(self, val: f64) -> Self

pub fn impersonation_session_duration(self, val: f64) -> Self

pub fn banned_user_message(self, val: impl Into<String>) -> Self

pub fn allow_impersonating_admins(self, val: bool) -> Self

impl AdminPlugin

pub fn banned_user_message_callback<U: AuthUser, H: AdminBannedUserMessage<U>>( self, handler: H, ) -> Self

Configure an awaited message callback over the exact stored user entity.

Trait Implementations

impl<S: AuthSchema> AuthPlugin<S> for AdminPlugin

fn name(&self) -> &'static str

Plugin name - should be unique

fn routes(&self) -> Vec<AuthRoute>

Routes that this plugin handles

fn on_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<Option<AuthResponse>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Called for each request - return Some(response) to handle, None to pass through

fn static_openapi_metadata(&self) -> PluginOpenApiMetadata

Base declarations for documentation without an initialized auth instance.

fn openapi_metadata(&self, ctx: &AuthInitContext<S>) -> PluginOpenApiMetadata

Documentation annotations collected after all plugins initialize. Override this hook for custom endpoints and model field policies.

fn server_endpoints(&self) -> Vec<EndpointDefinition>

Trusted operations available through host dispatch, independently of HTTP visibility.

fn validate_endpoint( &self, call: &EndpointCall, _: &AuthContext<S>, ) -> AuthResult<EndpointInput>

Validate actual input after all before-hook patches have been applied.

fn on_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, call: &'life1 EndpointCall, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<EndpointResponse>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Execute a registered operation with validated handler-phase context.

fn session_fields(&self) -> FieldConfigs

Session field policies contributed by this registered plugin.

fn on_init<'life0, 'life1, 'async_trait>( &'life0 self, ctx: &'life1 mut AuthInitContext<S>, ) -> Pin<Box<dyn Future<Output = AuthResult<()>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Called when the plugin is initialized

fn rate_limits(&self) -> Vec<PluginRateLimit>

Ordered rate-limit policies supplied by this installed plugin.

fn endpoint_hooks(&self) -> Vec<&dyn EndpointHook<S>>

Installed logical-call hooks, in this plugin’s registration order.

fn allowed_media_types(&self, _route: &AuthRoute) -> Vec<&'static str>

Media types accepted before request hooks and endpoint dispatch. An empty list disables the media restriction for an application-owned endpoint.

fn user_fields(&self) -> IndexMap<String, FieldConfig>

fn account_fields(&self) -> IndexMap<String, FieldConfig>

fn on_http_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect the original physical HTTP request before routing, body parsing, origin validation and endpoint hooks. Disabled paths and transport/rate limiting middleware run first. Returning a response stops dispatch and later plugin hooks. Server-only endpoint calls do not invoke this hook.

fn on_http_request_action<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<HttpRequestAction>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Inspect or replace the physical request. The default preserves existing on_http_request implementations. Request-local configuration has already been resolved from the incoming request, matching the Source HTTP handler.

fn on_http_response<'life0, 'life1, 'life2, 'life3, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, _response: &'life3 AuthResponse, ) -> Pin<Box<dyn Future<Output = Result<Option<AuthResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, 'life3: 'async_trait, Self: 'async_trait,

Observe the routed HTTP response before transport middleware (including CORS). Hooks run in registration order; the first replacement stops this chain. Early HTTP request-hook responses skip this stage. Errors escape dispatch; they cannot reverse writes already committed by an endpoint.

fn before_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<BeforeRequestAction>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after route matching and before endpoint dispatch.

fn on_http_endpoint<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: &'life1 AuthRequest, ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<Option<HttpEndpointResponse>, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Dispatch the resolved HTTP endpoint. Existing plugins return logical values through on_request; plugins returning a native raw response can override this method to bypass the endpoint after-hook pipeline.

fn after_request<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _req: &'life1 AuthRequest, _ctx: &'life2 AuthContext<S>, response: AuthResponse, ) -> Pin<Box<dyn Future<Output = Result<AuthResponse, AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Transform a completed response, including redirects and rejections.

fn on_user_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user: &'life1 <S as AuthSchema>::User, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after a user is created

fn on_session_created<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session: &'life1 <S as AuthSchema>::Session, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called after a session is created

fn on_user_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _user_id: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called before a user is deleted

fn on_session_deleted<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, _session_token: &'life1 str, _ctx: &'life2 AuthContext<S>, ) -> Pin<Box<dyn Future<Output = Result<(), AuthError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait, Self: 'async_trait,

Called before a session is deleted

impl Debug for AdminPlugin

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AdminPlugin

fn default() -> Self

Returns the “default value” for a type.