chronix_security/auth/
mod.rs

1//! # Authentication
2//!
3//! Authentication and encryption library for the Chronix time-series database.
4//!
5//! ## Features
6//!
7//! - **API key authentication** — Argon2-hashed keys with optional expiry
8//! - **JWT/OIDC authentication** — RS256/HS256 token validation with configurable claims
9//! - **mTLS authentication** — Client certificate identity extraction
10//! - **Encryption at rest** — AES-256-GCM authenticated encryption with key rotation
11//! - **Unified auth context** — Common `AuthContext` across all methods
12//!
13//! ## Architecture
14//!
15//! ```text
16//! Request → AuthMiddleware → [mTLS → JWT → API Key] → AuthContext
17//!                                                       ├── principal
18//!                                                       ├── method
19//!                                                       └── claims
20//! ```
21
22#![warn(missing_docs)]
23#![deny(unsafe_code)]
24
25pub mod api_key;
26pub mod encryption;
27pub mod error;
28pub mod jwt;
29pub mod middleware;
30pub mod mtls;
31pub mod oidc;
32pub mod rotation;
33
34/// Fill `dest` from the operating system's random source.
35///
36/// One definition for every secret this crate generates — nonces, data keys,
37/// API keys and password salts. `rand` 0.10 renamed the OS generator to
38/// `SysRng` and made it fallible, and a failure here means the kernel has no
39/// entropy source: there is no safe fallback, so it panics rather than
40/// returning a key nobody should trust.
41pub(crate) fn fill_random(dest: &mut [u8]) {
42    use rand::TryRng;
43    rand::rngs::SysRng
44        .try_fill_bytes(dest)
45        .expect("the operating system random source must be available");
46}
47
48pub use api_key::ApiKeyStore;
49pub use encryption::{EncryptionService, KeyProvider, SecretKey};
50pub use error::AuthError;
51pub use jwt::JwtValidator;
52pub use middleware::{AuthContext, AuthMethod, AuthMiddleware};
53pub use mtls::MtlsValidator;
54pub use oidc::{CachedKey, JwksCache};
55pub use rotation::{RotatingKeyProvider, RotationEvent, RotationPolicy, RotationReason};
chronix_security/auth/mod.rs

chronix_security/auth/
mod.rs
