pub struct UserPassAuth;Implementations§
Source§impl UserPassAuth
impl UserPassAuth
pub fn new() -> Self
pub fn hash_password(password: &str) -> AuthResult<String>
pub async fn user_exists( storage: &dyn StorageBackend, username: &str, ) -> AuthResult<bool>
Sourcepub async fn create_user(
storage: &dyn StorageBackend,
username: &str,
password: &str,
policies: Vec<String>,
) -> AuthResult<()>
pub async fn create_user( storage: &dyn StorageBackend, username: &str, password: &str, policies: Vec<String>, ) -> AuthResult<()>
Writes a user without validating anything, overwriting any existing
record. This is the bootstrap path: its credentials come from operator
configuration, which predates the HTTP rules and may not meet them
(a short password, an email-shaped name), and refusing them would stop
an existing deployment from starting. Everything reachable over HTTP
goes through Self::upsert_user instead.
Sourcepub async fn upsert_user(
storage: &dyn StorageBackend,
username: &str,
password: &str,
policies: Vec<String>,
) -> AuthResult<()>
pub async fn upsert_user( storage: &dyn StorageBackend, username: &str, password: &str, policies: Vec<String>, ) -> AuthResult<()>
Creates the user, or replaces it outright: the password is re-hashed under a fresh salt and the policy list is swapped, not merged, so the caller always knows exactly what the identity can do afterwards.
Tokens already issued keep the policies they were minted with until they expire — a replace narrows future logins, not live sessions.
Sourcepub async fn read_user(
storage: &dyn StorageBackend,
username: &str,
) -> AuthResult<Option<UserInfo>>
pub async fn read_user( storage: &dyn StorageBackend, username: &str, ) -> AuthResult<Option<UserInfo>>
The user’s name and policies, or None if there is no such user.
Never the hash: nothing outside login has any use for it.
Sourcepub async fn delete_user(
storage: &dyn StorageBackend,
username: &str,
) -> AuthResult<bool>
pub async fn delete_user( storage: &dyn StorageBackend, username: &str, ) -> AuthResult<bool>
Deletes the user, returning whether it existed. Tokens it already holds are not revoked — they are not indexed by owner — so they keep working until they expire, and a holder that renews them keeps them alive.