ferrox-security 0.1.0

Enterprise module ferrox-security for Ferrox Framework.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

use crate::{PasetoAuth, AuthPayload};
use ferrox_errors::AppError;
use secrecy::Secret;
use serde::{Deserialize, Serialize};

#[derive(Serialize, Deserialize)]
pub struct DualTokens {
    pub access_token: String,
    pub refresh_token: String,
}

pub struct DualTokenManager {
    paseto: PasetoAuth,
}

impl DualTokenManager {
    pub fn new(secret_key: Secret<String>) -> Self {
        Self {
            paseto: PasetoAuth::new(secret_key).unwrap(),
        }
    }

    /// Generates both an Access Token (short-lived) and a Refresh Token (long-lived).
    pub fn generate_tokens(&self, payload: &AuthPayload) -> Result<DualTokens, AppError> {
        // Access Token: 15 minutes
        let access_token = self.paseto.generate_token(payload, time::Duration::minutes(15))?;
        
        // Refresh Token: Usually stored in DB/Redis with a longer expiration and UUID.
        // For boilerplate, we generate a cryptographically strong random hex.
        // In a real implementation, you would save this to Redis/DB to allow revocation.
        use rand::RngCore;
        let mut key = [0u8; 32];
        rand::thread_rng().fill_bytes(&mut key);
        let refresh_token = hex::encode(key);

        Ok(DualTokens {
            access_token,
            refresh_token,
        })
    }

    /// Verifies the Access token. If it fails, the frontend should use the Refresh Token
    /// on a dedicated endpoint to get a new pair.
    pub fn verify_access_token(&self, token: &str) -> Result<String, AppError> {
        let claims = self.paseto.validate_token(token)?;
        Ok(claims.user_id)
    }
}