genies_auth_admin

Unified Authentication Administration Center for the Genies (神灯) framework — a full-featured management backend for users, roles, permissions, departments, and multi-application authorization.

Overview

genies_auth_admin is the management interface of the Genies permission system. While genies_auth serves as the core RBAC permission engine library (Casbin Enforcer, middleware, field-level filtering), genies_auth_admin provides a complete admin backend with:

• A full set of RESTful APIs for managing users, roles, permissions, departments, and applications
• Built-in JWT-based authentication (login / logout / token refresh)
• A Vue 3 + Element Plus web UI embedded directly into the binary via rust-embed
• Multi-application API proxy — manage Casbin policies of remote microservices from a single dashboard
• Domain-Driven Design (DDD) layered architecture

Features

• User Management: CRUD, status toggle, password reset, role assignment, permission query, batch delete
• Role Management: CRUD, user listing, permission assignment / revocation
• Permission Management: CRUD for fine-grained permission items
• Department Management: CRUD, tree-based move, user listing by department
• Application Registry: Register microservices with their base URLs and manage their authorization remotely
• API Proxy: Forward policy / role / group / schema / reload requests to target microservices' /auth/* endpoints
• Local JWT Auth: Self-contained login flow with bcrypt password hashing and JWT token issuance
• Casbin Integration: JWT authentication + Casbin RBAC permission check on all protected routes
• Field-Level Permission Filtering: Inherits genies_auth's #[casbin] macro for response field filtering
• Embedded Web UI: SPA frontend served from /auth-admin/ui/ with intelligent cache control
• OpenAPI Auto-Sync: Extracts schemas from OpenAPI docs and syncs to the permission system
• Flyway Migrations: Auto-creates all required database tables on startup
• Dapr Event Bus: Publishes CloudEvents after CRUD operations; downstream genies_auth syncs Casbin rules

Architecture

DDD Layered Structure

src/
├── main.rs                    # Entry point — init, migration, routing, server start
├── lib.rs                     # Library root
├── interfaces/                # Interface Layer
│   ├── router.rs              #   Route definitions (public + protected)
│   ├── admin_ui.rs            #   Embedded SPA static asset serving
│   ├── handler/               #   HTTP handlers
│   │   ├── auth_handler.rs    #     Login / Logout / Refresh / Me / Change password
│   │   ├── user_handler.rs    #     User CRUD + role assignment
│   │   ├── role_handler.rs    #     Role CRUD + permission assignment
│   │   ├── permission_handler.rs  # Permission CRUD
│   │   ├── department_handler.rs  # Department CRUD + move
│   │   ├── application_handler.rs # Application registry CRUD
│   │   └── app_proxy_handler.rs   # Multi-app API proxy
│   └── dto/                   #   Request / Response DTOs
├── application/               # Application Layer
│   ├── service.rs             #   AuthService, UserService, RoleService, etc.
│   ├── app_service.rs         #   ApplicationAppService
│   └── dto.rs                 #   Shared DTOs (LoginResponse, PageQuery, etc.)
├── domain/                    # Domain Layer
│   ├── entity/                #   AdminUser, AdminRole, AdminPermission, AdminDepartment, ApplicationEntity
│   ├── aggregate/             #   Aggregate roots (User, Role, Permission, Department)
│   ├── service/               #   UserDomainService, RoleDomainService, ApplicationDomainService
│   ├── repository/            #   RBatis repository implementations
│   └── event/                 #   Domain events (UserEvent, RoleEvent)
└── infrastructure/            # Infrastructure Layer
    └── migration.rs           #   Flyway migration runner

Middleware Flow

Request → JWT Auth (local_auth) → Casbin RBAC (casbin_auth) → Handler → Writer (field filter) → Response

Public routes (login, logout, refresh, admin UI) bypass authentication.

Tech Stack

API Reference

Public Routes (No Auth)

Protected Routes (JWT + Casbin)

Auth

Users

Roles

Permissions

Departments

Applications

App Proxy (Forward to Target Microservice)

Database Tables

Auto-created via Flyway migrations:

Tables from genies_auth migrations (created first):

Configuration

Key fields in application.yml:

server_name: "auth-admin"
servlet_path: "/auth-admin"
server_url: "0.0.0.0:9099"

database_url: "mysql://root:password@127.0.0.1:3306/auth_admin_service"

# JWT
jwt_secret: "auth_admin_jwt_secret_change_in_production"
auth_mode: "local"

# Redis
cache_type: "redis"
redis_url: "redis://127.0.0.1:6379"

# Dapr
dapr_pubsub_name: messagebus

Getting Started

Prerequisites

• Rust 1.75+
• MySQL 5.7+ / 8.0
• Redis
• (Optional) Dapr runtime for event-driven sync

Run the Service

cargo run -p genies_auth_admin

The service starts at http://127.0.0.1:9099.

Access the Web UI

Open your browser and navigate to:

http://127.0.0.1:9099/auth-admin/ui/

Note: The trailing slash / is required for the SPA to load correctly.

Build the Frontend (Development)

cd crates/auth-admin/web

npm install

npm run dev      # Dev server with hot reload

npm run build    # Production build → ../static/

Relationship with genies_auth

genies_auth_admin uses genies_auth as its authentication and authorization backbone: all protected routes pass through genies_auth's local_auth (JWT verification) and casbin_auth (RBAC check) middleware.

License

See the project root for license information.