authkestra 0.13.0

A modular authentication framework for Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

//! Authkestra is a modular authentication framework for Rust.
//!
//! This crate serves as a facade, re-exporting functionality from other `authkestra-*` crates
//! based on enabled features.

/// The engine: `Engine`, the auth methods, the flows, the token machinery
/// and the stores.
///
/// This is the *only* name the facade gives `authkestra-engine`. It used to
/// also be re-exported as `flow` and `token`, from when `authkestra-flow` and
/// `authkestra-token` were separate crates (RFC-001, since merged into
/// `authkestra-engine`). Those aliases outlived the crates they were named
/// after: all three resolved to the same crate, so `authkestra::flow::` handed
/// you the token and session machinery too, and `token` was gated on
/// `feature = "token"` while re-exporting everything that feature does not
/// cover. Both are gone — reach any of it through `core`.
#[cfg(feature = "engine")]
pub use authkestra_engine as core;

/// Type alias for the Engine to support the Authkestra::builder() pattern.
#[cfg(feature = "engine")]
pub type Authkestra<S = authkestra_engine::Missing, T = authkestra_engine::Missing> =
    authkestra_engine::Engine<S, T>;

/// Session, token and credential stores, plus the memory/Redis/SQL backends.
///
/// A short path to [`core::store`]; which backends exist inside it is decided
/// by the engine's own feature gates, not re-gated here. The gate is the set
/// of storage backends — it was previously `feature = "session"` alone, with
/// a *second* copy of the same module exported as `persistence` under a wider
/// gate, so which name worked depended on which feature you happened to
/// enable. The `session` feature itself no longer exists; the store traits
/// live in [`core::auth`] and are reachable without picking a backend.
#[cfg(any(
    feature = "memory",
    feature = "redis",
    feature = "sql-postgres",
    feature = "sql-mysql",
    feature = "sql-sqlite"
))]
pub use authkestra_engine::store;

/// WebAuthn passkey authentication.
#[cfg(feature = "webauthn")]
pub use authkestra_engine::webauthn;

/// Time-based One-Time Password (TOTP) authentication.
#[cfg(feature = "totp")]
pub use authkestra_engine::totp;

#[cfg(feature = "oidc")]
pub use authkestra_oidc as oidc;

/// Cedar policy engine — **proof of concept**, see
/// [authkestra#21](https://github.com/marcjazz/authkestra/issues/21) and
/// `docs/rfc-008-policy-engine.md`.
///
/// Re-exported so it can be tried behind one feature flag, but it is not wired into any guard,
/// extractor, or middleware yet: enabling `policy` adds an authorization engine you call
/// yourself, it does not change how any existing route is protected.
#[cfg(feature = "policy")]
pub use authkestra_policy as policy;
/// Shared Signals Framework (RFC 8417 / RFC 8935) and CAEP event ingestion.
///
/// Only the receiving half — validating SETs and decoding CAEP events. Reacting to an event
/// (session revocation, middleware enforcement) is not implemented yet; see the crate docs and
/// [authkestra#25](https://github.com/marcjazz/authkestra/issues/25).
#[cfg(feature = "ssf")]
pub use authkestra_ssf as ssf;

#[cfg(feature = "axum")]
pub use authkestra_axum as axum;

#[cfg(feature = "actix")]
pub use authkestra_actix as actix;

/// The OpenID Provider server: `OpConfig`, `OpStore` and the handlers the
/// adapters' `op` routes are built from.
///
/// Re-exported alongside the adapters' `op` feature because those routes are
/// configured with types from this crate — forwarding the feature without it
/// would leave the endpoints reachable but unconfigurable (#325).
#[cfg(feature = "op")]
pub use authkestra_op as op;

/// Device and service signatures: `DeviceIdentity`, `SignedRequest` and the
/// verification entry points the adapters' `devsig` layers wrap.
#[cfg(feature = "devsig")]
pub use authkestra_devsig as devsig;

/// Authentication providers.
pub mod providers {
    #[cfg(feature = "github")]
    pub use authkestra_providers::github;

    #[cfg(feature = "google")]
    pub use authkestra_providers::google;

    #[cfg(feature = "discord")]
    pub use authkestra_providers::discord;
}