rustio_admin/auth/
mod.rs

1//! Authentication & authorization.
2//!
3//! Three pieces:
4//! - `users.rs`       — user records, password hashing, login
5//! - `sessions.rs`    — DB-backed sessions with expiry cleanup
6//! - `permissions.rs` — granular permissions + groups
7//!
8//! A user belongs to zero or more groups. Permissions come from two
9//! sources: (a) direct assignments on the user, (b) inherited from
10//! the user's groups. The permission string is
11//! `<app>.<action>_<model>` — e.g. `posts.change_post`.
12
13pub mod guards;
14pub(crate) mod mfa;
15mod permissions;
16pub(crate) mod recovery;
17pub(crate) mod recovery_admin;
18mod role;
19mod sessions;
20mod users;
21
22pub use mfa::MfaPolicy;
23pub(crate) use permissions::invalidate_user_cache;
24pub use permissions::{
25    add_user_to_group, check_permission, create_group, grant_to_group, grant_to_user,
26    init_permission_tables, permissions_for_user, register_model_permissions,
27    remove_user_from_group, Permission, PermissionError, Superuser,
28};
29pub use recovery::{
30    DefaultPasswordPolicy, DefaultRecoveryPolicy, LoginThrottle, PasswordPolicy,
31    PasswordPolicyError, RecoveryPolicy, SharedPasswordPolicy, SharedRecoveryPolicy,
32};
33// `issue_reset_token` / `consume_reset_token` and the `IssueOutcome` /
34// `ConsumeOutcome` / `MailerEmailStatus` types live in `recovery`
35// (`pub(crate) mod recovery`) so the admin handlers in commit #8+
36// reach them as `crate::auth::recovery::*`. They are intentionally
37// NOT re-exported here — the framework owns the handler shape, and
38// projects compose recovery via the trait surfaces re-exported above.
39// `purge_expired_reset_tokens` (R1 commit #12) is reached the same
40// way from `background::spawn_session_sweeper`.
41pub use role::{protected_roles, Role};
42pub use sessions::{
43    create_session, current_session_id, delete_session, identity_from_session, init_session_tables,
44    invalidate_sessions, list_active_for_user, logout_session, purge_expired_sessions,
45    session_token_from_cookie, InvalidationOutcome, Session, SessionInvalidationReason,
46    SessionTarget, SessionTrust, SESSION_COOKIE,
47};
48#[allow(deprecated)]
49pub use users::would_orphan_developers;
50pub use users::{
51    create_user, find_user_by_email, hash_password, init_user_tables, load_user_profile, login,
52    migrate_user_schema, set_password, update_user_role, verdict_for_orphan_role, verify_password,
53    would_orphan_protected, would_orphan_role, Identity, StoredUser, UserProfile,
54};
55
56use crate::error::Result;
57use crate::orm::Db;
58
59/// Initialise every auth-related table. Safe to call on every boot.
60pub async fn init_tables(db: &Db) -> Result<()> {
61    init_user_tables(db).await?;
62    migrate_user_schema(db).await?;
63    init_session_tables(db).await?;
64    sessions::migrate_session_schema(db).await?;
65    sessions::migrate_session_lifecycle(db).await?;
66    init_permission_tables(db).await?;
67    // R1 (0.5.0) — self password recovery schema. See
68    // DESIGN_RECOVERY.md §9 for the contract.
69    recovery::migrate_user_recovery_schema(db).await?;
70    recovery::init_recovery_tables(db).await?;
71    // R2 (0.6.0) — organisational recovery schema (lockout columns +
72    // partial index). See DESIGN_R2_ORGANISATIONAL.md §4 for the
73    // contract. Schema is additive and orthogonal to R1's recovery
74    // tables; the runtime that reads these columns lands in later
75    // R2 commits.
76    recovery_admin::migrate_user_lockout_schema(db).await?;
77    // R3 (0.7.0) — TOTP MFA schema (4 additive columns on
78    // rustio_users + new rustio_mfa_backup_codes table + partial
79    // index). See DESIGN_R3_MFA.md §7 for the contract. Schema
80    // is additive and orthogonal to R1 / R2; the encryption
81    // helpers, TOTP RFC 6238 implementation, enrolment /
82    // verification / disable runtime, and login-flow integration
83    // land in later R3 commits.
84    mfa::migrate_user_mfa_schema(db).await?;
85    // R2 (0.6.0) — surfaced by the testcontainers integration suite:
86    // `rustio_admin_actions` was previously created lazily on first
87    // dashboard hit (`handlers::ensure_audit_ready`), so any audit-
88    // emitting path that ran BEFORE someone visited `/admin` would
89    // fail. The R2 audit-heavy paths (auto-throttle, admin reset,
90    // admin lock/unlock/revoke, forced rotation) made this latent
91    // issue routinely reachable. Creating the table eagerly during
92    // boot closes the gap; `ensure_table` is already idempotent so
93    // this is safe to call alongside the lazy path that still
94    // exists in the dashboard handler.
95    crate::admin::audit::ensure_table(db).await?;
96    Ok(())
97}
rustio_admin/auth/mod.rs

rustio_admin/auth/
mod.rs
