authvault 0.1.0

Authentication and authorization vault with multi-provider support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

<!-- AI-DD-META:START -->
<!-- This repository is planned, maintained, and managed by AI Agents only. -->
<!-- Slop issues are expected and intentionally present as part of an HITL-less -->
<!-- /minimized AI-DD metaproject of learning, refining, and building brute-force -->
<!-- training for both agents and the human operator. -->
![Downloads](https://img.shields.io/github/downloads/KooshaPari/Authvault/total?style=flat-square&label=downloads&color=blue)
![GitHub release](https://img.shields.io/github/v/release/KooshaPari/Authvault?style=flat-square&label=release)
![License](https://img.shields.io/github/license/KooshaPari/Authvault?style=flat-square)
![AI-Slop](https://img.shields.io/badge/AI--DD-Slop%20Expected-orange?style=flat-square)
![AI-Only-Maintained](https://img.shields.io/badge/Planned%20%26%20Maintained%20by-AI%20Agents%20Only-red?style=flat-square)
![HITL-less](https://img.shields.io/badge/HITL--less%20AI--DD-metaproject-yellow?style=flat-square)

> ⚠️ **AI-Agent-Only Repository**
>
> This repo is **planned, maintained, and managed exclusively by AI Agents**.
> Slop issues, rough edges, and AI artifacts are **expected and intentionally
> present** as part of an **HITL-less / minimized AI-DD** metaproject focused
> on learning, refining, and brute-force training both the agents and the
> human operator. Bug reports and contributions are still welcome, but please
> expect AI-generated code, comments, and documentation throughout.
<!-- AI-DD-META:END -->
> **Work state:** ACTIVE · **Progress:** `███████░░░ 70%`
> Hexagonal auth framework (OAuth2/JWT/RBAC); security+session+token audits complete · updated 2026-06-02

# Authvault

**Authentication and authorization framework with OAuth2, JWT, and RBAC/ABAC support.**

## Consolidated Auth Family

Authvault is now the umbrella repo for the Phenotype auth surface. Imported subtrees live at:

- `authkit/` - Rust staging SDK and security crates
- `typescript/phenotype-auth-ts/` - TypeScript auth library and docs

A hexagonal architecture-based authentication framework supporting:

- **Multiple Auth Methods**: JWT, OAuth2, API Keys, Session tokens
- **Authorization Models**: RBAC, ABAC, PBAC with policy engine
- **User Management**: Registration, login, password reset
- **Session Management**: Token refresh, revocation, rotation
- **Multi-tenancy**: Tenant isolation, domain-based routing
- **Audit Logging**: Complete auth event logging

## Architecture

```
authvault/
├── src/
│   ├── domain/          # Core domain logic (pure)
│   │   ├── identity.rs # User entities
│   │   ├── auth.rs     # Authentication logic
│   │   ├── policy.rs   # Authorization policies
│   │   ├── session.rs  # Session management
│   │   ├── ports.rs    # Interface definitions
│   │   └── errors.rs   # Domain errors
│   ├── application/     # Application services
│   ├── adapters/        # Infrastructure adapters
│   └── infrastructure/  # Cross-cutting concerns
```

## Features

- [x] JWT tokens with RS256/HS256
- [x] OAuth2 client credentials flow
- [x] Password hashing (argon2, bcrypt)
- [x] RBAC with role hierarchy
- [x] ABAC with attribute-based policies
- [x] Session management with refresh tokens
- [x] Rate limiting
- [x] Audit logging
- [ ] Multi-factor authentication
- [ ] Passwordless authentication
- [ ] Delegation and federation

## Installation

```toml
[dependencies]
authvault = "0.1"
```

## Quick Start

```rust
use authvault::{Authenticator, Claims};

let auth = Authenticator::new(secret_key)?;
let token = auth.generate_token(user_id, roles)?;
let claims = auth.verify_token(&token)?;
```

## Development

```bash
cargo build
cargo test
cargo clippy -- -D warnings
cargo fmt
```

## Runtime Configuration

The `serve` example binds to `127.0.0.1:8080` by default. Set `BIND_ADDR` to listen
on a different address:

```bash
BIND_ADDR=0.0.0.0:8080 cargo run --example serve
```

## License

MIT OR Apache-2.0