rainier-auth

Authentication and authorization: [Guard]s that say who is making a request, and a [Gate] that says whether they may.

let provider = Arc::new(RepositoryUserProvider::new(users, hasher));
let auth = Arc::new(
    AuthManager::<User>::new("web")
        .register(Arc::new(SessionGuard::new("web", provider.clone(), sessions)))
        .register(Arc::new(TokenGuard::new("api", provider))),
);

middleware.alias_factory("auth", move |args| {
    Ok(Arc::new(Authenticate::from_args(auth.clone(), args)) as Arc<_>)
});

router.get("/me", show).middleware(["auth:api"]);

One user type per manager

[AuthManager] is generic over the user model rather than yielding dyn Authenticatable. An application has one user model and wants it back with its own type; erasing it would only force a downcast at every call site. An application with genuinely distinct user kinds — customers and staff, in different tables — registers one manager each, which is clearer than one registry returning different shapes.