Struct Auth 

pub struct Auth { /* private fields */ }

The auth extension: holds the derived session, token-at-rest, and JWT keys, registered as a dependency so Session/Bearer extractors can resolve it.

Each store is rotation-aware (multi-key decrypt): the keys derived from the primary secret encrypt new data, while keys derived from any retired secrets only decrypt pre-rotation data (see Auth::with_secrets).

Implementations

impl Auth

pub fn with_secret(secret: &str) -> Self

Build from an explicit secret (>= 32 bytes recommended), with no retired secrets. Equivalent to with_secrets(secret, &[]).

pub fn with_secrets(primary: &str, retired: &[&str]) -> Self

Build with key rotation: primary encrypts new sessions/tokens; each of retired can still decrypt sessions/tokens minted before rotation but is never used to encrypt. Move the previous JERRYCAN_SECRET into retired to rotate without logging users out, then drop it once you want its sessions/tokens fully invalidated.

pub fn from_env() -> Result<Self>

Build from JERRYCAN_SECRET (primary) plus optional JERRYCAN_SECRET_OLD (a comma-separated list of retired secrets for key rotation).

The insecure built-in dev key is used ONLY when JERRYCAN_ENV is unset/empty or an explicit dev marker (dev/development/test/local). Any other value — including any production spelling (production, prod-eu, …) or a typo — is treated as production: a missing or short primary secret is then a loud error (fail closed), and each non-empty retired secret must also meet MIN_SECRET_LEN (empty entries are skipped — JERRYCAN_SECRET_OLD="" or a trailing comma is harmless). When JERRYCAN_SECRET_OLD is unset, behavior is identical to a single secret.

pub fn sessions(&self) -> &SessionStore

pub fn tokens(&self) -> &SessionStore

The token-at-rest codec (rotation-aware, keyed independently of sessions). Encrypt an OAuth TokenResponse with auth.tokens().encode(&t)? before persisting the ciphertext; decode on read. Key rotation applies automatically, exactly as for sessions.

pub fn jwt_key(&self) -> &[u8; 32]

Trait Implementations

impl Clone for Auth

fn clone(&self) -> Auth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Extension for Auth

fn register(self, app: App) -> App