kirino 0.7.7

Zero-trust authentication and authorization framework with RBAC and dynamic risk assessment.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126

use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use uuid::Uuid;

/// Invitation mode.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum InvitationMode {
    /// Admin sends form, invitee applies, admin approves.
    Approval,
    /// Admin generates a unique link, invitee registers directly.
    Direct,
}

/// Invitation lifecycle status.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum InvitationStatus {
    /// Created but not yet opened or used.
    Pending,
    /// Link has been opened (Direct mode only), 5-min clock running.
    Opened,
    /// Successfully accepted.
    Accepted,
    /// Past expiry, never used.
    Expired,
    /// Explicitly revoked by admin.
    Revoked,
    /// Fully consumed (max_uses reached for multi-use).
    Exhausted,
}

impl InvitationStatus {
    pub fn as_str(self) -> &'static str {
        match self {
            Self::Pending => "pending",
            Self::Opened => "opened",
            Self::Accepted => "accepted",
            Self::Expired => "expired",
            Self::Revoked => "revoked",
            Self::Exhausted => "exhausted",
        }
    }
}

impl std::fmt::Display for InvitationStatus {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
}

/// An invitation record.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Invitation {
    pub id: Uuid,
    /// 256-bit hex token, URL-safe.
    pub token: String,
    /// Target group the invitee joins on acceptance.
    pub group_id: Uuid,
    /// Admin who created the invitation.
    pub invited_by: Uuid,
    pub mode: InvitationMode,
    /// Optional email for Approval mode.
    pub invitee_email: Option<String>,
    /// Role assigned on join.
    pub role: String,
    /// Maximum number of redemptions (1 = single-use).
    pub max_uses: u16,
    /// Current redemption count.
    pub use_count: u16,
    /// Whether the same IP/machine may use multiple different links.
    pub allow_multi_ip: bool,
    pub status: InvitationStatus,
    /// When the link was first opened (Direct mode).
    pub opened_at: Option<DateTime<Utc>>,
    /// IP that first opened the link.
    pub opened_ip: Option<String>,
    /// User-Agent that first opened the link.
    pub opened_ua: Option<String>,
    /// Absolute expiry timestamp.
    pub expires_at: DateTime<Utc>,
    /// When the invitation was accepted.
    pub accepted_at: Option<DateTime<Utc>>,
    /// User ID that accepted.
    pub accepted_by: Option<Uuid>,
    pub created_at: DateTime<Utc>,
}

/// Parameters for creating an invitation.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CreateInvitationParams {
    pub group_id: Uuid,
    pub mode: InvitationMode,
    pub invitee_email: Option<String>,
    pub role: Option<String>,
    pub max_uses: Option<u16>,
    pub allow_multi_ip: Option<bool>,
    /// Lifetime in seconds from creation. Default: 604800 (7 days).
    pub ttl_secs: Option<u64>,
    /// Direct-mode window in seconds from first open. Default: 300 (5 min).
    pub open_window_secs: Option<u64>,
}

/// Parameters for accepting an invitation.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AcceptInvitationParams {
    pub token: String,
    pub username: String,
    pub password: String,
    pub email: Option<String>,
    /// Client IP for binding checks.
    pub client_ip: Option<String>,
    /// Client User-Agent for binding checks.
    pub client_ua: Option<String>,
}

/// Result of opening an invitation link (Direct-mode pre-registration).
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct OpenInvitationResult {
    pub token: String,
    pub group_id: Uuid,
    pub group_name: Option<String>,
    pub invited_by_name: Option<String>,
    /// Seconds remaining in the open window.
    pub window_remaining_secs: i64,
}