sz-orm-auth 5.0.0

SZ-ORM Authentication & Authorization Extension
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

[package]

name = "sz-orm-auth"

version.workspace = true

edition.workspace = true

authors.workspace = true

license.workspace = true

repository.workspace = true

homepage.workspace = true

keywords.workspace = true

categories.workspace = true

description = "SZ-ORM Authentication & Authorization Extension"



[features]

default = []

# v4.9.0：OWASP Top 10 完整覆盖渗透测试套件（编译门控，默认关闭）

owasp-pentest-suite = []

# v3.8.0：JWT 签名密钥轮换机制

prod-jwt-key-rotation = []





[package.metadata.cargo-machete]

ignored = ['async-trait', 'thiserror', 'tokio']

[dependencies]

async-trait = "0.1"

tokio = { version = "1.40", features = ["full"] }

thiserror = "2.0"

serde = { version = "1.0", features = ["derive"] }

serde_json = "1.0"

# RustCrypto 加密原语：替代手写 SHA-256 / HMAC-SHA256

sha2 = "0.10"

# SHA-1 用于 TOTP/HOTP (RFC 4226/6238) 的 HMAC-SHA1

sha1 = "0.10"

hmac = "0.12"

# base64 URL-safe (no padding) 编解码，替代手写实现

base64 = "0.22"

# v0.2.2 修复 H-3：常量时间比较，防止 JWT 签名校验的时序攻击

subtle = "2.5"

# v1.2.1 修复 Critical C-1/C-2/C-3：使用 OsRng 替代 DefaultHasher 生成 MFA 密钥/OAuth2 授权码/令牌家族 ID

# 与 sz-orm-crypto 保持一致（CWE-338 弱 PRNG 修复）

rand = "0.8"

# 锁毒化修复：使用 parking_lot 替代 std::sync，消除 .lock().unwrap() panic 风险

parking_lot.workspace = true



[dev-dependencies]

tokio-test = "0.4"



[lints]

workspace = true



[[test]]

name = "owasp_a09_auth_failures"

required-features = ["owasp-pentest-suite"]



[[test]]

name = "owasp_csrf"

required-features = ["owasp-pentest-suite"]