laterite_auth/lib.rs
1//! Laterite auth: backend user authentication and authorization.
2//!
3//! Provides the operator-facing security primitives the admin surface is
4//! built on: Argon2id password hashing, opaque server-side sessions, a
5//! role-based permission model over dotted permission strings, brute-force
6//! throttling, and an append-only access log. "Backend users" are the
7//! operators of the admin, kept distinct from any application's end users.
8//!
9//! This crate is HTTP-agnostic on purpose. It exposes an [`AuthService`] with
10//! plain async methods (`authenticate`, `verify_session`, `logout`) plus an
11//! [`AuthenticatedUser`] identity; the admin crate wraps these in Axum
12//! extractors, cookie handling, and the rendered login screen.
13
14pub mod error;
15pub mod migrations;
16pub mod password;
17pub mod permission;
18pub mod service;
19pub mod store;
20
21mod models;
22mod schema;
23
24pub use error::AuthError;
25pub use migrations::{migrations, MODULE_ID};
26pub use models::{AccessEvent, BackendUser, BackendUserSummary};
27pub use permission::PermissionSet;
28pub use service::{
29 AuthConfig, AuthService, AuthenticatedUser, IssuedSession, NewOperator, RequestContext,
30};