sz-orm-auth 1.2.1

SZ-ORM Authentication & Authorization Extension
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

[package]

name = "sz-orm-auth"

version.workspace = true

edition.workspace = true

authors.workspace = true

license.workspace = true

repository.workspace = true

homepage.workspace = true

keywords.workspace = true

categories.workspace = true

description = "SZ-ORM Authentication & Authorization Extension"



[dependencies]

async-trait = "0.1"

tokio = { version = "1.40", features = ["full"] }

thiserror = "2.0"

serde = { version = "1.0", features = ["derive"] }

serde_json = "1.0"

# RustCrypto 加密原语：替代手写 SHA-256 / HMAC-SHA256

sha2 = "0.10"

# SHA-1 用于 TOTP/HOTP (RFC 4226/6238) 的 HMAC-SHA1

sha1 = "0.10"

hmac = "0.12"

# base64 URL-safe (no padding) 编解码，替代手写实现

base64 = "0.22"

# v0.2.2 修复 H-3：常量时间比较，防止 JWT 签名校验的时序攻击

subtle = "2.5"

# v1.2.1 修复 Critical C-1/C-2/C-3：使用 OsRng 替代 DefaultHasher 生成 MFA 密钥/OAuth2 授权码/令牌家族 ID

# 与 sz-orm-crypto 保持一致（CWE-338 弱 PRNG 修复）

rand = "0.8"

# 锁毒化修复：使用 parking_lot 替代 std::sync，消除 .lock().unwrap() panic 风险

parking_lot.workspace = true



[dev-dependencies]

tokio-test = "0.4"



[lints]

workspace = true