⚠️ AI-Agent-Only Repository

This repo is planned, maintained, and managed exclusively by AI Agents. Slop issues, rough edges, and AI artifacts are expected and intentionally present as part of an HITL-less / minimized AI-DD metaproject focused on learning, refining, and brute-force training both the agents and the human operator. Bug reports and contributions are still welcome, but please expect AI-generated code, comments, and documentation throughout.

Work state: ACTIVE · Progress: ███████░░░ 70% Hexagonal auth framework (OAuth2/JWT/RBAC); security+session+token audits complete · updated 2026-06-02

Authvault

Authentication and authorization framework with OAuth2, JWT, and RBAC/ABAC support.

Consolidated Auth Family

Authvault is now the umbrella repo for the Phenotype auth surface. Imported subtrees live at:

• authkit/ - Rust staging SDK and security crates
• typescript/phenotype-auth-ts/ - TypeScript auth library and docs

A hexagonal architecture-based authentication framework supporting:

• Multiple Auth Methods: JWT, OAuth2, API Keys, Session tokens
• Authorization Models: RBAC, ABAC, PBAC with policy engine
• User Management: Registration, login, password reset
• Session Management: Token refresh, revocation, rotation
• Multi-tenancy: Tenant isolation, domain-based routing
• Audit Logging: Complete auth event logging

Architecture

authvault/
├── src/
│   ├── domain/          # Core domain logic (pure)
│   │   ├── identity.rs # User entities
│   │   ├── auth.rs     # Authentication logic
│   │   ├── policy.rs   # Authorization policies
│   │   ├── session.rs  # Session management
│   │   ├── ports.rs    # Interface definitions
│   │   └── errors.rs   # Domain errors
│   ├── application/     # Application services
│   ├── adapters/        # Infrastructure adapters
│   └── infrastructure/  # Cross-cutting concerns

Features

• JWT tokens with RS256/HS256
• OAuth2 client credentials flow
• Password hashing (argon2, bcrypt)
• RBAC with role hierarchy
• ABAC with attribute-based policies
• Session management with refresh tokens
• Rate limiting
• Audit logging
• Multi-factor authentication
• Passwordless authentication
• Delegation and federation

Installation

[dependencies]
authvault = "0.1"

Quick Start

use authvault::{Authenticator, Claims};

let auth = Authenticator::new(secret_key)?;
let token = auth.generate_token(user_id, roles)?;
let claims = auth.verify_token(&token)?;

Development

cargo build
cargo test
cargo clippy -- -D warnings
cargo fmt

Runtime Configuration

The serve example binds to 127.0.0.1:8080 by default. Set BIND_ADDR to listen on a different address:

BIND_ADDR=0.0.0.0:8080 cargo run --example serve

License

MIT OR Apache-2.0