alibi_plugins/
lib.rs

1//! Built-in authentication plugins for Alibi.
2
3#![cfg_attr(
4    test,
5    allow(
6        unused_results,
7        unreachable_pub,
8        reason = "test code intentionally discards setup return values and exposes helpers broadly"
9    )
10)]
11
12#[cfg(all(feature = "native-tls", feature = "rustls"))]
13compile_error!(
14    "features `native-tls` and `rustls` are mutually exclusive. \
15     Enable exactly one of them: \
16     for `native-tls` (default), remove the `rustls` feature; \
17     for `rustls`, set `default-features = false, features = [\"rustls\"]`."
18);
19
20#[cfg(not(any(feature = "native-tls", feature = "rustls")))]
21compile_error!(
22    "one of the TLS backends must be enabled: \
23     enable either the `native-tls` (default) or `rustls` feature."
24);
25
26/// Expand to the `OpenAPI` metadata methods of a plugin whose documentation
27/// comes entirely from its registered routes.
28macro_rules! route_openapi_metadata {
29    ($schema:ident) => {
30        fn static_openapi_metadata(&self) -> alibi_core::PluginOpenApiMetadata {
31            crate::metadata::plugin_metadata(
32                <Self as alibi_core::AuthPlugin<$schema>>::name(self),
33                &<Self as alibi_core::AuthPlugin<$schema>>::routes(self),
34            )
35        }
36
37        fn openapi_metadata(
38            &self,
39            ctx: &alibi_core::AuthInitContext<$schema>,
40        ) -> alibi_core::PluginOpenApiMetadata {
41            crate::metadata::instance_plugin_metadata(
42                <Self as alibi_core::AuthPlugin<$schema>>::name(self),
43                &<Self as alibi_core::AuthPlugin<$schema>>::routes(self),
44                ctx,
45            )
46        }
47    };
48}
49
50pub mod access;
51pub mod account_management;
52pub mod admin;
53pub mod anonymous;
54pub mod api_key;
55pub(crate) mod authentication_helpers;
56pub mod bearer;
57pub mod captcha;
58pub mod custom_session;
59pub mod device_authorization;
60pub mod email_otp;
61pub mod email_password;
62pub mod email_verification;
63mod endpoint;
64pub mod haveibeenpwned;
65pub mod helpers;
66pub mod jwt;
67pub mod last_login_method;
68pub mod magic_link;
69pub mod metadata;
70pub mod multi_session;
71pub mod oauth;
72pub mod oauth_popup;
73pub mod oauth_provider;
74pub mod oauth_proxy;
75pub mod one_tap;
76pub mod one_time_token;
77pub mod open_api;
78pub mod organization;
79#[cfg(feature = "passkey")]
80pub mod passkey;
81pub mod password_management;
82mod passwordless_numeric;
83pub mod phone_number;
84pub mod session_management;
85pub mod siwe;
86pub mod sso;
87pub(crate) mod token_crypto;
88pub mod two_factor;
89pub mod user_management;
90
91// LCOV_EXCL_START
92#[cfg(test)]
93pub(crate) mod test_helpers {
94    use alibi_core::config::AuthConfig;
95    use alibi_core::wire::{SessionView, UserView};
96    use alibi_core::{AuthContext, AuthRequest, CreateSession, CreateUser, HttpMethod};
97    use alibi_seaorm::store::__private_test_support::bundled_schema::BundledSchema;
98    use alibi_seaorm::{Database, SeaOrmStore};
99    use chrono::{Duration, Utc};
100    use std::collections::HashMap;
101    use std::sync::Arc;
102
103    pub type TestDatabase = dyn alibi_core::store::AuthStore<BundledSchema>;
104
105    pub fn create_test_config() -> AuthConfig {
106        AuthConfig::new("test-secret-key-at-least-32-chars-long")
107    }
108
109    pub async fn create_test_database() -> Arc<TestDatabase> {
110        let database = Database::connect("sqlite::memory:")
111            .await
112            .expect("sqlite test database should connect");
113        alibi_seaorm::store::__private_test_support::migrator::run_migrations(&database)
114            .await
115            .expect("sqlite test migrations should run");
116        Arc::new(SeaOrmStore::<BundledSchema>::new(
117            Arc::new(create_test_config()),
118            database,
119        ))
120    }
121
122    pub async fn create_test_context() -> AuthContext<BundledSchema> {
123        create_test_context_with_config(create_test_config()).await
124    }
125
126    pub fn create_test_context_blocking() -> AuthContext<BundledSchema> {
127        tokio::runtime::Builder::new_current_thread()
128            .enable_all()
129            .build()
130            .expect("test runtime should build")
131            .block_on(create_test_context())
132    }
133
134    pub async fn create_test_context_with_config(config: AuthConfig) -> AuthContext<BundledSchema> {
135        let config = Arc::new(config);
136        let database = create_test_database().await;
137        AuthContext::new(config, database)
138    }
139
140    pub async fn create_user(
141        ctx: &AuthContext<impl alibi_core::AuthSchema>,
142        create_user: CreateUser,
143    ) -> UserView {
144        let user = ctx.database.create_user(create_user).await.unwrap();
145        UserView::from(&user)
146    }
147
148    pub async fn create_session(
149        ctx: &AuthContext<impl alibi_core::AuthSchema>,
150        user_id: String,
151        expires_in: Duration,
152    ) -> SessionView {
153        let create_session = CreateSession {
154            additional_fields: alibi_core::field_policy::FieldValues::default(),
155            token: None,
156            active_team_id: None,
157            user_id,
158            expires_at: Utc::now() + expires_in,
159            ip_address: Some("127.0.0.1".to_owned()),
160            user_agent: Some("test-agent".to_owned()),
161            impersonated_by: None,
162            active_organization_id: None,
163        };
164        let session = ctx.database.create_session(create_session).await.unwrap();
165        SessionView::from(&session)
166    }
167
168    pub async fn create_user_and_session(
169        ctx: &AuthContext<impl alibi_core::AuthSchema>,
170        user_data: CreateUser,
171        session_expires_in: Duration,
172    ) -> (UserView, SessionView) {
173        let user = create_user(ctx, user_data).await;
174        let session = create_session(ctx, user.id.clone(), session_expires_in).await;
175        (user, session)
176    }
177
178    pub async fn create_test_context_with_user(
179        create_user: CreateUser,
180        session_expires_in: Duration,
181    ) -> (AuthContext<BundledSchema>, UserView, SessionView) {
182        let ctx = create_test_context().await;
183        let (user, session) = create_user_and_session(&ctx, create_user, session_expires_in).await;
184        (ctx, user, session)
185    }
186
187    pub fn create_auth_request(
188        method: HttpMethod,
189        path: &str,
190        token: Option<&str>,
191        body: Option<Vec<u8>>,
192        query: HashMap<String, String>,
193    ) -> AuthRequest {
194        let mut headers = HashMap::new();
195        if let Some(token) = token {
196            let config = create_test_config();
197            headers.insert(
198                "cookie".to_owned(),
199                format!(
200                    "{}={}",
201                    config.session.cookie_name,
202                    alibi_core::utils::cookie_utils::sign_cookie_value(
203                        token,
204                        config.current_secret()
205                    )
206                ),
207            );
208        }
209
210        AuthRequest::from_parts(method, path.to_owned(), headers, body, query)
211    }
212
213    pub fn create_auth_request_no_query(
214        method: HttpMethod,
215        path: &str,
216        token: Option<&str>,
217        body: Option<Vec<u8>>,
218    ) -> AuthRequest {
219        create_auth_request(method, path, token, body, HashMap::new())
220    }
221
222    pub fn create_auth_json_request_no_query(
223        method: HttpMethod,
224        path: &str,
225        token: Option<&str>,
226        body: Option<serde_json::Value>,
227    ) -> AuthRequest {
228        create_auth_json_request(method, path, token, body, HashMap::new())
229    }
230
231    pub fn create_auth_json_request(
232        method: HttpMethod,
233        path: &str,
234        token: Option<&str>,
235        body: Option<serde_json::Value>,
236        query: HashMap<String, String>,
237    ) -> AuthRequest {
238        let mut req = create_auth_request(
239            method,
240            path,
241            token,
242            body.map(|b| serde_json::to_vec(&b).unwrap()),
243            query,
244        );
245        req.headers
246            .insert("content-type".to_owned(), "application/json".to_owned());
247        req
248    }
249}
250// LCOV_EXCL_STOP
251
252pub use account_management::AccountManagementPlugin;
253pub use admin::{
254    AdminBanUserRequest, AdminBannedUserMessage, AdminBannedUserMessageHandler, AdminConfig,
255    AdminCreateUserRequest, AdminImpersonationResponse, AdminListUsersQuery,
256    AdminListUsersResponse, AdminPermissionRequest, AdminPermissionResponse, AdminPlugin,
257    AdminRoleInput, AdminSetRoleRequest, AdminSetUserPasswordRequest, AdminSuccessResponse,
258    AdminUpdateUserRequest, AdminUserOutput, AdminUserResponse, AdminUserSessionsResponse,
259    RolePermissions,
260};
261pub use alibi_core::PasswordHasher;
262pub use anonymous::{
263    AnonymousConfig, AnonymousIdentity, AnonymousLink, AnonymousPlugin, LinkAnonymousAccount,
264};
265pub use api_key::{
266    ApiKeyCallbackContext, ApiKeyConfig, ApiKeyDefaultPermissions, ApiKeyErrorMessage,
267    ApiKeyGenerationOptions, ApiKeyGenerator, ApiKeyGetter, ApiKeyPermissions, ApiKeyPlugin,
268    ApiKeyValidator, DeleteExpiredApiKeysResponse,
269};
270pub use bearer::{BearerConfig, BearerPlugin};
271pub use captcha::{CaptchaConfig, CaptchaPlugin, CaptchaProvider};
272pub use custom_session::{CustomSessionPlugin, SessionTransform};
273pub use device_authorization::DeviceAuthorizationPlugin;
274pub use email_otp::{EmailOtpConfig, EmailOtpPlugin, SendEmailOtp};
275pub use email_password::{EmailPasswordConfig, EmailPasswordPlugin};
276pub use email_verification::{
277    EmailVerificationConfig, EmailVerificationHook, EmailVerificationPlugin, SendVerificationEmail,
278};
279pub use haveibeenpwned::{HaveIBeenPwnedConfig, HaveIBeenPwnedPlugin, PwnedPasswordClient};
280pub use last_login_method::{
281    BeforeStoreLastLoginMethodCookie, LastLoginMethodConfig, LastLoginMethodContext,
282    LastLoginMethodPlugin, ResolveLastLoginMethod,
283};
284pub use magic_link::{MagicLinkConfig, MagicLinkPlugin, SendMagicLink};
285pub use multi_session::{MultiSessionConfig, MultiSessionPlugin};
286pub use oauth::OAuthPlugin;
287pub use oauth_popup::OAuthPopupPlugin;
288pub use oauth_provider::{
289    OAuthClientPrivilegeContext, OAuthClientPrivileges, OAuthProviderConfig, OAuthProviderPlugin,
290};
291pub use oauth_proxy::{OAuthProxyConfig, OAuthProxyPlugin};
292pub use one_tap::{OAuthJwksSource, OneTapClientId, OneTapConfig, OneTapPlugin};
293pub use open_api::{OpenApiConfig, OpenApiPlugin};
294pub use organization::{
295    OrganizationConfig, OrganizationCreatePatch, OrganizationCreatedContext,
296    OrganizationCreationHooks, OrganizationDraftContext, OrganizationMemberCreatePatch,
297    OrganizationMemberDraftContext, OrganizationPlugin,
298};
299#[cfg(feature = "passkey")]
300pub use passkey::{
301    AuthenticationResult, PasskeyAuthenticationAfterVerification, PasskeyAuthenticationConfig,
302    PasskeyAuthenticationContext, PasskeyAuthenticatorSelection, PasskeyConfig, PasskeyExtensions,
303    PasskeyExtensionsResolver, PasskeyOptionsContext, PasskeyPlugin,
304    PasskeyRegistrationAfterVerification, PasskeyRegistrationConfig, PasskeyRegistrationContext,
305    PasskeyRegistrationOverride, PasskeyRegistrationUser, PasskeyUserResolver,
306    VerifiedPasskeyAuthentication, VerifiedPasskeyRegistration,
307};
308pub use password_management::{
309    PasswordManagementConfig, PasswordManagementPlugin, SendResetPassword,
310};
311pub use phone_number::{PhoneNumberConfig, PhoneNumberPlugin, SendPhoneOtp};
312pub use session_management::{GetSessionQuery, GetSessionResponse, SessionManagementPlugin};
313pub use siwe::{SiweConfig, SiwePlugin};
314pub use two_factor::{
315    SendTwoFactorOtp, TwoFactorBackupCipher, TwoFactorBackupStorage, TwoFactorConfig,
316    TwoFactorOtpCipher, TwoFactorOtpHasher, TwoFactorOtpStorage, TwoFactorPlugin,
317};
318pub use user_management::{
319    ChangeEmailConfig, DeleteUserConfig, SendChangeEmailConfirmation, UserManagementConfig,
320    UserManagementPlugin,
321};
322
323#[derive(Debug, serde::Serialize, serde::Deserialize)]
324pub(crate) struct StatusResponse {
325    status: bool,
326}
327
328pub use sso::{SsoConfig, SsoPlugin};
alibi_plugins/lib.rs

alibi_plugins/
lib.rs
