Crate laterite_auth 

Laterite auth: backend user authentication and authorization.

Provides the operator-facing security primitives the admin surface is built on: Argon2id password hashing, opaque server-side sessions, a role-based permission model over dotted permission strings, brute-force throttling, and an append-only access log. “Backend users” are the operators of the admin, kept distinct from any application’s end users.

This crate is HTTP-agnostic on purpose. It exposes an AuthService with plain async methods (authenticate, verify_session, logout) plus an AuthenticatedUser identity; the admin crate wraps these in Axum extractors, cookie handling, and the rendered login screen.

Re-exports

pub use audit_listener::AuditListener;

pub use error::AuthError;

pub use migrations::migrations;

pub use migrations::MODULE_ID;

pub use permission::PermissionSet;

pub use service::ActiveSession;

pub use service::AuditEntry;

pub use service::AuthConfig;

pub use service::AuthService;

pub use service::AuthenticatedUser;

pub use service::IssuedSession;

pub use service::NewOperator;

pub use service::PasswordPolicy;

pub use service::Purged;

pub use service::RecalledSession;

pub use service::RememberCredential;

pub use service::RequestContext;

pub use service::ResolvedSession;

pub use service::MIN_PASSWORD_LENGTH;

pub use store::AccessRecord;

pub use store::AuditRecord;

pub use store::RevokeReason;

pub use store::SessionEnd;

Modules

audit_listener

The audit writer as a model listener.

error

Auth error taxonomy.

events

The facts the auth service announces on the event bus.

migrations

The auth schema, as portable one-file migrations.

password

Argon2id password hashing.

permission

The permission model.

service

The authentication and authorization service.

store

Data access for the auth schema.

Structs

AuthModule

The laterite.auth module: the framework’s backend-user auth tables.

BackendUser

A backend user: an operator of the admin surface.

BackendUserSummary

A lightweight backend-user projection for listings (no credential fields).

Enums

AccessEvent

The kind of event recorded in the access log.

Constants

ROLE_ADMIN

The built-in role every administrative permission belongs to. Held by the first operator, and by anyone who should administer the panel itself.

ROLE_EDITOR

The built-in role for working with content rather than the panel. Empty on a bare framework: a permission joins it by naming it.