axess-core 0.11.0

Core implementation for the axess library. Session state machine, multi-factor authentication engine, Cedar Policy evaluation, and pluggable storage backends. Use the `axess` facade crate unless you need direct access to internals. 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

//! Owner claims and the bindings compare-and-swap on the in-memory store.

use super::*;
use crate::device::types::DeviceBinding;
use chrono::TimeZone;

fn tenant() -> TenantId {
    crate::authn::ids::testing::tenant("tenant-1")
}

fn at() -> DateTime<Utc> {
    Utc.with_ymd_and_hms(2026, 6, 1, 0, 0, 0).unwrap()
}

fn unowned() -> Device {
    Device {
        id: crate::authn::ids::testing::device("dev"),
        tenant_id: tenant(),
        user_id: None,
        trust_level: DeviceTrustLevel::Unknown,
        fingerprint_hash: FingerprintHash::from_bytes([1; 32]),
        first_seen_at: at(),
        last_seen_at: at(),
        revoked_at: None,
        demoted_at: None,
        bindings: Vec::new(),
    }
}

fn refresh(family: &str) -> DeviceBinding {
    DeviceBinding::Refresh {
        family_id: family.into(),
        issued_at: at(),
        last_used_at: at(),
    }
}

#[tokio::test]
async fn the_first_claim_wins_and_the_second_user_is_refused() {
    let store = MemoryDeviceStore::new();
    let d = unowned();
    store.save(&d, crate::device::test_now()).await.unwrap();
    let (a, b) = (
        crate::authn::ids::testing::user("a"),
        crate::authn::ids::testing::user("b"),
    );
    assert_eq!(
        store
            .claim_owner(&tenant(), &d.id, &a, crate::device::test_now())
            .await
            .unwrap(),
        OwnerClaim::Claimed
    );
    assert_eq!(
        store
            .claim_owner(&tenant(), &d.id, &b, crate::device::test_now())
            .await
            .unwrap(),
        OwnerClaim::OwnedByOther
    );
    assert_eq!(
        store
            .claim_owner(&tenant(), &d.id, &a, crate::device::test_now())
            .await
            .unwrap(),
        OwnerClaim::Claimed,
        "claiming again as the owner is idempotent"
    );
    let ghost = crate::authn::ids::testing::device("ghost");
    assert_eq!(
        store
            .claim_owner(&tenant(), &ghost, &a, crate::device::test_now())
            .await
            .unwrap(),
        OwnerClaim::Missing
    );
    let row = store.load(&tenant(), &d.id).await.unwrap().unwrap();
    assert_eq!(row.user_id, Some(a));
}

#[tokio::test]
async fn a_stale_bindings_write_conflicts_and_keeps_the_other_edit() {
    let store = MemoryDeviceStore::new();
    let d = unowned();
    store.save(&d, crate::device::test_now()).await.unwrap();
    // Two editors read the empty bindings; the first writes.
    let first = store
        .replace_bindings(
            &tenant(),
            &d.id,
            &[],
            &[refresh("fam-1")],
            crate::device::test_now(),
        )
        .await
        .unwrap();
    assert_eq!(first, BindingsUpdate::Written);
    let second = store
        .replace_bindings(
            &tenant(),
            &d.id,
            &[],
            &[refresh("fam-2")],
            crate::device::test_now(),
        )
        .await
        .unwrap();
    assert_eq!(second, BindingsUpdate::Conflict);
    let row = store.load(&tenant(), &d.id).await.unwrap().unwrap();
    assert_eq!(row.bindings, vec![refresh("fam-1")]);
}