Crate larust_auth 

Session-backed authentication and lightweight authorization - Laravel’s Auth facade, auth/guest middleware, and authorize() helper, re-exported through larust_support::auth (see crates/larust-support/src/lib.rs) so generated apps depend only on larust-support, never on this crate directly.

Structs

Auth

Extracts the currently authenticated user, or rejects with 401 if there isn’t one - for handlers that require a logged-in user and want the User itself, not just a yes/no check. Pair with the require_auth middleware (which redirects a guest to the login page) on routes meant for browsers; use Auth<U> alone on routes meant to fail loudly instead (e.g. an API endpoint).

Traits

Authenticatable

Implemented by an app’s User model (or whatever it calls its authenticatable type) so larust_support::auth’s guard functions and the crate::Auth extractor can look a user up from the id stored in the session.

Policy

A per-resource authorization policy (Laravel’s Policy classes), hand- implemented once per model - the same shape as crate::Authenticatable on User: a small trait the app implements directly, not macro-generated or auto-discovered, so a typo in an ability name is a compile error rather than a silently-always-false runtime lookup.

Functions

authorize

Converts a boolean authorization check into a 403 on failure (Laravel’s $this->authorize(...) controller helper). Not a Gate-style runtime registry - write the actual check as a plain typed method on your own model (impl Post { pub fn can_update(&self, user: &User) -> bool { self.user_id == user.id } }) and convert it at the call site: authorize(post.can_update(&user))?;. A typo in an ability name this way is a compile error, not a silently-always-false runtime lookup.

check

Whether the current session is authenticated (Laravel’s Auth::check()). Operates on the default ("web") guard; for a named second guard, use check_for instead.

check_for

check’s named-guard counterpart (Laravel’s Auth::guard('admin')->check()).

hash_password

Hashes a plaintext password for storage (Laravel’s Hash::make()).

id

The current session’s authenticated user id, if any (Laravel’s Auth::id()). Operates on the default ("web") guard; for a named second guard, use id_for instead.

id_for

id’s named-guard counterpart (Laravel’s Auth::guard('admin')->id()).

login

Logs a user in (Laravel’s Auth::login($user)): rotates the session ID before storing the authenticated user, so a session token an attacker captured pre-login (session fixation) can’t be reused to inherit the now-authenticated session - then stores Authenticatable::auth_id, under U::GUARD’s own session slot, for later requests to look the user back up via user/the crate::Auth extractor. Logging in as a second guard (e.g. Admin after User) doesn’t disturb the first guard’s own login state - each has its own slot.

logout

Logs the current user out (Laravel’s Auth::logout()). Flushes the entire session, not just the auth key - a clean logout should also invalidate anything else tied to that session (e.g. the CSRF token), not leave it half-authenticated. Operates on the default ("web") guard; for a named second guard, use logout_for instead, which clears only that guard’s own slot and leaves the rest of the session - including any other guard’s login state - untouched.

logout_for

logout’s named-guard counterpart: removes only U::GUARD’s own session slot (Laravel’s Auth::guard('admin')->logout()), leaving the rest of the session - including any other guard’s login state - intact.

redirect_authenticated

The inverse of require_auth: bounces an already-logged-in user away from guest-only routes (Laravel’s guest middleware - typically wrapped around /login//register) to "/", rather than running the handler.

redirect_authenticated_for

redirect_authenticated’s named-guard counterpart - bounces a user already logged in as U::GUARD away from that guard’s own guest-only routes (e.g. /admin/login), regardless of whether some other guard is also logged in.

require_auth

Redirects a guest to "login" (falling back to a hardcoded /login, with a warning, if that route name isn’t registered - the same degrade pattern larust_support::redirect()->route() already uses) rather than running the handler. Pair with routes that require a logged-in user (Laravel’s auth middleware); use the crate::Auth extractor instead on routes that should fail with a 401 rather than redirect.

require_auth_for

require_auth’s named-guard counterpart (Laravel’s Auth::guard('admin') protecting a route group) - redirects unless U::GUARD specifically is logged in, regardless of whether some other guard is. Used as require_auth_for::<Admin>, e.g. r.middleware(axum::middleware::from_fn(require_auth_for::<Admin>)).

user

The current session’s authenticated user, if any (Laravel’s Auth::user()), resolved through U::GUARD’s own session slot - so user::<User>(&session) and user::<Admin>(&session) read independent login state even though they share one Session. Ok(None) covers both “not logged in” and “logged in as a user id that no longer exists”

verify_password

Checks a plaintext password against a stored hash (Laravel’s Hash::check()). Returns Ok(false) for a wrong password - only a malformed/corrupt stored hash is an Err, since that’s the only case that isn’t a normal, expected verification outcome.