rainier_auth/lib.rs
1//! # rainier-auth
2//!
3//! Authentication and authorization: [`Guard`]s that say *who* is making a
4//! request, and a [`Gate`] that says *whether they may*.
5//!
6//! | | |
7//! |---|---|
8//! | [`Authenticatable`] | what the framework needs to know about a user model |
9//! | [`UserProvider`] / [`RepositoryUserProvider`] | how users are found and their credentials verified |
10//! | [`Hasher`] / [`Argon2Hasher`] | password hashing |
11//! | [`Guard`] / [`TokenGuard`] / [`SessionGuard`] | how a request is tied to a user |
12//! | [`AuthManager`] | named guards — `auth:api` |
13//! | [`Authenticate`] | the middleware that enforces it |
14//! | [`Gate`] | abilities and policies |
15//!
16//! ```ignore
17//! let provider = Arc::new(RepositoryUserProvider::new(users, hasher));
18//! let auth = Arc::new(
19//! AuthManager::<User>::new("web")
20//! .register(Arc::new(SessionGuard::new("web", provider.clone(), sessions)))
21//! .register(Arc::new(TokenGuard::new("api", provider))),
22//! );
23//!
24//! middleware.alias_factory("auth", move |args| {
25//! Ok(Arc::new(Authenticate::from_args(auth.clone(), args)) as Arc<_>)
26//! });
27//!
28//! router.get("/me", show).middleware(["auth:api"]);
29//! ```
30//!
31//! ## One user type per manager
32//!
33//! [`AuthManager`] is generic over the user model rather than yielding
34//! `dyn Authenticatable`. An application has one user model and wants it back
35//! with its own type; erasing it would only force a downcast at every call
36//! site. An application with genuinely distinct user kinds — customers and
37//! staff, in different tables — registers one manager each, which is clearer
38//! than one registry returning different shapes.
39
40#![deny(missing_docs)]
41#![deny(rustdoc::broken_intra_doc_links)]
42
43pub mod abilities;
44pub mod challenge;
45pub mod confirm;
46pub mod gate;
47pub mod guard;
48pub mod hashing;
49pub mod legacy;
50pub mod middleware;
51pub mod session;
52pub mod user;
53
54pub use abilities::Abilities;
55pub use challenge::Challenges;
56pub use confirm::{confirm_password, ConfirmPassword};
57pub use gate::{Actor, Gate};
58pub use guard::{AuthManager, Guard, GuardExt, SessionGuard, StatefulGuard, TokenGuard};
59pub use hashing::{Argon2Hasher, Hasher};
60#[cfg(feature = "bcrypt")]
61pub use legacy::BcryptVerifier;
62pub use legacy::LegacyVerifier;
63pub use middleware::{
64 AbilitiesRequestExt, Authenticate, AuthenticatedUser, RedirectIfAuthenticated, RequireAbility,
65 TokenAbilities,
66};
67pub use session::{generate_session_id, MemorySessionStore, Session, SessionStore, AUTH_KEY};
68pub use user::{Authenticatable, Credentials, RepositoryUserProvider, UserProvider};
69
70// Re-exported so implementors get the attribute macro without adding the
71// dependency themselves.
72pub use async_trait::async_trait;