fraiseql_auth/
lib.rs

1//! Authentication, authorization, and session management for FraiseQL.
2//!
3//! Handles JWT validation, OAuth/OIDC flows, session management, and authorization.
4
5#![forbid(unsafe_code)]
6#![allow(clippy::needless_pass_by_value)] // Reason: axum extractors require owned types
7#![allow(clippy::doc_markdown)] // Reason: technical terms (OAuth2, PKCE, OIDC, HMAC) throughout docs
8
9pub mod account_linking;
10pub mod anonymous;
11pub mod audit;
12pub mod constant_time;
13pub mod error;
14pub mod error_sanitizer;
15pub mod handlers;
16pub mod jwks;
17pub mod jwt;
18pub mod middleware;
19pub mod monitoring;
20pub mod multi_provider;
21pub mod oauth;
22pub mod oidc_provider;
23pub mod oidc_server_client;
24pub mod operation_rbac;
25pub mod otp;
26pub mod phone_otp;
27pub mod pkce;
28pub mod provider;
29pub mod providers;
30pub mod proxy;
31pub mod rate_limiting;
32pub mod security_config;
33pub mod security_init;
34pub mod session;
35pub mod session_postgres;
36pub mod social;
37pub mod state_encryption;
38pub mod state_store;
39pub mod totp_mfa;
40
41#[cfg(test)]
42mod security_tests;
43
44#[cfg(test)]
45mod error_sanitization_tests;
46
47#[cfg(test)]
48mod constant_time_tests;
49
50#[cfg(test)]
51mod state_encryption_tests;
52
53#[cfg(test)]
54mod rate_limiting_tests;
55
56#[cfg(test)]
57mod integration_security_tests;
58
59#[cfg(test)]
60mod advanced_auth_integration_tests;
61
62#[cfg(test)]
63mod tests;
64
65pub use account_linking::{
66    AccountLinkResult, AccountRecord, AccountStore, InMemoryAccountStore, ProviderLink,
67    normalize_email,
68};
69pub use anonymous::{AnonSignupResponse, AnonSignupState, anon_signup, upgrade_anonymous_session};
70pub use audit::logger::{
71    AuditEntry, AuditEventType, AuditExt, AuditLogger, SecretType, StructuredAuditLogger,
72    get_audit_logger, init_audit_logger,
73};
74pub use constant_time::ConstantTimeOps;
75pub use error::{AuthError, Result};
76pub use error_sanitizer::{
77    AuthErrorSanitizer, Sanitize, SanitizedError, messages as error_messages,
78};
79pub use handlers::{
80    AuthCallbackQuery, AuthLogoutRequest, AuthRefreshRequest, AuthStartRequest, AuthState,
81    auth_callback, auth_logout, auth_refresh, auth_start,
82};
83pub use jwks::{JwksCache, JwksError};
84pub use jwt::{Claims, JwtValidator, generate_hs256_token, generate_rs256_token};
85pub use middleware::{AuthMiddleware, AuthenticatedUser};
86pub use monitoring::{AuthEvent, AuthMetrics, OperationTimer};
87pub use multi_provider::{
88    AuthTokenResponse, AuthorizeQuery, CallbackQuery, MultiProviderAuthState, ProvidersResponse,
89    authorize, callback, list_providers,
90};
91pub use oauth::{
92    AuthorizationRequest, ExternalAuthProvider, IdTokenClaims, NonceParameter, OAuth2Client,
93    OAuth2ClientConfig, OAuthAuditEvent, OAuthSession, OIDCClient, OIDCProviderConfig,
94    PKCEChallenge, ProviderFailoverManager, ProviderRegistry, ProviderType, StateParameter,
95    TokenRefreshScheduler, TokenRefreshWorker, TokenRefresher,
96};
97pub use oidc_provider::OidcProvider;
98pub use oidc_server_client::{OidcEndpoints, OidcServerClient, OidcTokenResponse};
99pub use operation_rbac::{OperationPermission, RBACPolicy, Role};
100pub use otp::{
101    EmailDelivery, InMemoryOtpStore, NoopEmailDelivery, OtpRequest, OtpResponse, OtpRouteState,
102    OtpStore, VerifyRequest, otp_send, otp_verify,
103};
104pub use phone_otp::{
105    InMemorySmsSender, SmsOtpAuthState, SmsOtpRequest, SmsOtpResponse, SmsSender, SmsVerifyRequest,
106    SmsVerifyResponse, normalize_e164, send_sms_otp, verify_sms_otp,
107};
108pub use pkce::{ConsumedPkceState, PkceError, PkceStateStore};
109pub use provider::{OAuthProvider, PkceChallenge, TokenResponse, UserInfo};
110pub use providers::{AzureADOAuth, GitHubOAuth, GoogleOAuth, KeycloakOAuth, create_provider};
111pub use proxy::ProxyConfig;
112pub use rate_limiting::{AuthRateLimitConfig, Clock, KeyedRateLimiter, RateLimiters, SystemClock};
113pub use security_config::{
114    AuditLoggingSettings, ErrorSanitizationSettings, RateLimitingSettings,
115    SecurityConfigFromSchema, StateEncryptionSettings,
116};
117pub use security_init::{
118    init_default_security_config, init_security_config, log_security_config,
119    validate_security_config,
120};
121pub use session::{SessionData, SessionStore, TokenPair, unix_now};
122pub use session_postgres::PostgresSessionStore;
123pub use social::{
124    SocialAuthorizeParams, SocialLoginState, SocialProviderRegistry, social_authorize,
125};
126pub use state_encryption::{
127    DecryptionError, EncryptedState, EncryptionAlgorithm, KeyError, StateEncryption,
128    StateEncryptionConfig, StateEncryptionService, generate_state_encryption_key,
129};
130pub use state_store::{InMemoryStateStore, StateStore};
131pub use totp_mfa::{
132    EnrollmentResponse, InMemoryMfaStore, MfaRouteState, MfaStore, TotpEnrollment, mfa_challenge,
133    mfa_enroll, mfa_unenroll, mfa_verify,
134};
fraiseql_auth/lib.rs

fraiseql_auth/
lib.rs
