Crate fraiseql_auth 

Authentication, authorization, and session management for FraiseQL.

Handles JWT validation, OAuth/OIDC flows, session management, and authorization.

Re-exports

pub use account_linking::AccountLinkResult;

pub use account_linking::AccountRecord;

pub use account_linking::AccountStore;

pub use account_linking::InMemoryAccountStore;

pub use account_linking::PostgresAccountStore;

pub use account_linking::ProviderLink;

pub use account_linking::TrustedEmailProviders;

pub use account_linking::normalize_email;

pub use anonymous::AnonSignupResponse;

pub use anonymous::AnonSignupState;

pub use anonymous::anon_signup;

pub use anonymous::upgrade_anonymous_session;

pub use audit::logger::AuditEntry;

pub use audit::logger::AuditEventType;

pub use audit::logger::AuditExt;

pub use audit::logger::AuditLogger;

pub use audit::logger::SecretType;

pub use audit::logger::StructuredAuditLogger;

pub use audit::logger::get_audit_logger;

pub use audit::logger::init_audit_logger;

pub use constant_time::ConstantTimeOps;

pub use error::AuthError;

pub use error::Result;

pub use error_sanitizer::AuthErrorSanitizer;

pub use error_sanitizer::Sanitize;

pub use error_sanitizer::SanitizedError;

pub use error_sanitizer::messages as error_messages;

pub use handlers::AuthCallbackQuery;

pub use handlers::AuthLogoutRequest;

pub use handlers::AuthRefreshRequest;

pub use handlers::AuthStartRequest;

pub use handlers::AuthState;

pub use handlers::auth_callback;

pub use handlers::auth_logout;

pub use handlers::auth_refresh;

pub use handlers::auth_start;

pub use jwks::JwksCache;

pub use jwks::JwksError;

pub use jwt::Claims;

pub use jwt::JwtValidator;

pub use jwt::generate_hs256_token;

pub use jwt::generate_rs256_token;

pub use local_password::LocalPasswordAuthenticator;

pub use local_password::PASSWORD_RESET_SCHEMA_SQL;

pub use local_password::PASSWORD_SCHEMA_SQL;

pub use local_password::RESET_TOKEN_TTL_SECS;

pub use local_password::ResetEmailSender;

pub use middleware::AuthMiddleware;

pub use middleware::AuthenticatedUser;

pub use monitoring::AuthEvent;

pub use monitoring::AuthMetrics;

pub use monitoring::OperationTimer;

pub use multi_provider::AuthTokenResponse;

pub use multi_provider::AuthorizeQuery;

pub use multi_provider::CallbackQuery;

pub use multi_provider::MultiProviderAuthState;

pub use multi_provider::ProvidersResponse;

pub use multi_provider::authorize;

pub use multi_provider::callback;

pub use multi_provider::list_providers;

pub use oauth::AuthorizationRequest;

pub use oauth::ExternalAuthProvider;

pub use oauth::IdTokenClaims;

pub use oauth::NonceParameter;

pub use oauth::OAuth2Client;

pub use oauth::OAuth2ClientConfig;

pub use oauth::OAuthAuditEvent;

pub use oauth::OAuthSession;

pub use oauth::OIDCClient;

pub use oauth::OIDCProviderConfig;

pub use oauth::PKCEChallenge;

pub use oauth::ProviderFailoverManager;

pub use oauth::ProviderRegistry;

pub use oauth::ProviderType;

pub use oauth::StateParameter;

pub use oauth::TokenRefreshScheduler;

pub use oauth::TokenRefreshWorker;

pub use oauth::TokenRefresher;

pub use oidc_provider::OidcProvider;

pub use oidc_server_client::OidcEndpoints;

pub use oidc_server_client::OidcServerClient;

pub use oidc_server_client::OidcTokenResponse;

pub use operation_rbac::OperationPermission;

pub use operation_rbac::RBACPolicy;

pub use operation_rbac::Role;

pub use otp::EmailDelivery;

pub use otp::InMemoryOtpStore;

pub use otp::NoopEmailDelivery;

pub use otp::OtpRequest;

pub use otp::OtpResponse;

pub use otp::OtpRouteState;

pub use otp::OtpStore;

pub use otp::VerifyRequest;

pub use otp::otp_send;

pub use otp::otp_verify;

pub use phone_otp::InMemorySmsSender;

pub use phone_otp::SmsOtpAuthState;

pub use phone_otp::SmsOtpRequest;

pub use phone_otp::SmsOtpResponse;

pub use phone_otp::SmsSender;

pub use phone_otp::SmsVerifyRequest;

pub use phone_otp::SmsVerifyResponse;

pub use phone_otp::normalize_e164;

pub use phone_otp::send_sms_otp;

pub use phone_otp::verify_sms_otp;

pub use pkce::ConsumedPkceState;

pub use pkce::PkceError;

pub use pkce::PkceStateStore;

pub use provider::OAuthProvider;

pub use provider::PkceChallenge;

pub use provider::TokenResponse;

pub use provider::UserInfo;

pub use providers::AzureADOAuth;

pub use providers::GitHubOAuth;

pub use providers::GoogleOAuth;

pub use providers::KeycloakOAuth;

pub use providers::create_provider;

pub use proxy::ProxyConfig;

pub use rate_limiting::AuthRateLimitConfig;

pub use rate_limiting::Clock;

pub use rate_limiting::KeyedRateLimiter;

pub use rate_limiting::RateLimiters;

pub use rate_limiting::SystemClock;

pub use security_config::AuditLoggingSettings;

pub use security_config::ErrorSanitizationSettings;

pub use security_config::SecurityConfigFromSchema;

pub use security_config::StateEncryptionSettings;

pub use security_init::init_default_security_config;

pub use security_init::init_security_config;

pub use security_init::log_security_config;

pub use security_init::validate_security_config;

pub use session::SessionData;

pub use session::SessionStore;

pub use session::TokenPair;

pub use session::unix_now;

pub use session_postgres::PostgresSessionStore;

pub use social::SocialAuthorizeParams;

pub use social::SocialLoginState;

pub use social::SocialProviderRegistry;

pub use social::social_authorize;

pub use state_encryption::DecryptionError;

pub use state_encryption::EncryptedState;

pub use state_encryption::EncryptionAlgorithm;

pub use state_encryption::KeyError;

pub use state_encryption::StateEncryption;

pub use state_encryption::StateEncryptionConfig;

pub use state_encryption::StateEncryptionService;

pub use state_encryption::generate_state_encryption_key;

pub use state_store::InMemoryStateStore;

pub use state_store::StateStore;

pub use totp_mfa::EnrollmentResponse;

pub use totp_mfa::InMemoryMfaStore;

pub use totp_mfa::MfaRouteState;

pub use totp_mfa::MfaStore;

pub use totp_mfa::TotpEnrollment;

pub use totp_mfa::mfa_challenge;

pub use totp_mfa::mfa_enroll;

pub use totp_mfa::mfa_unenroll;

pub use totp_mfa::mfa_verify;

Modules

account_linking

Account linking — merge provider identities sharing the same verified email.

anonymous

Anonymous session creation — POST /auth/v1/signup.

audit

Audit logging for security-critical authentication operations.

constant_time

Constant-time comparison utilities to prevent timing-based side-channel attacks.

error

Internal OIDC/JWT/session errors for the auth subsystem.

error_sanitizer

Error sanitization layer — separates user-facing messages from internal details.

handlers

HTTP handlers for the built-in authentication endpoints (/auth/start, /auth/callback, /auth/refresh, /auth/logout).

jwks

JWKS (JSON Web Key Set) cache for OIDC ID token signature verification.

jwt

JWT validation, claims parsing, and token generation.

local_password

Local email + password authentication using Argon2id.

middleware

Authentication middleware for Axum request handlers.

monitoring

Authentication monitoring and observability.

multi_provider

Multi-provider authentication — unified entry point for social login.

oauth

OAuth2 and OIDC authentication support with JWT validation, provider discovery, and automatic user provisioning.

oidc_provider

Generic OIDC provider implementation using RFC 8414 discovery.

oidc_server_client

Server-side OIDC client for PKCE authorization code flows.

operation_rbac

Operation-level Role-Based Access Control (RBAC).

otp

One-time password (OTP) authentication — email magic links and 6-digit codes.

phone_otp

Phone-based OTP authentication (SMS).

pkce

PKCE state store — RFC 7636 Proof Key for Code Exchange.

provider

OAuth 2.0 / OIDC provider trait and core data types.

providers

Provider-specific OAuth / OIDC implementations.

proxy

Proxy and IP address extraction with security validation

rate_limiting

Rate limiting for brute-force and abuse protection.

security_config

Security configuration loading and initialization

security_init

Security system initialization from compiled schema configuration

session

Session management — trait definition and helper functions.

session_postgres

PostgreSQL-backed SessionStore implementation.

social

Unified social login entry point.

state_encryption

State encryption for PKCE and OAuth state parameter protection.

state_store

CSRF state store — trait definition and backends.

totp_mfa

TOTP MFA (RFC 6238) — enroll, challenge, verify, unenroll.