Crate laterite_auth 

Laterite auth: backend user authentication and authorization.

Provides the operator-facing security primitives the admin surface is built on: Argon2id password hashing, opaque server-side sessions, a role-based permission model over dotted permission strings, brute-force throttling, and an append-only access log. “Backend users” are the operators of the admin, kept distinct from any application’s end users.

This crate is HTTP-agnostic on purpose. It exposes an AuthService with plain async methods (authenticate, verify_session, logout) plus an AuthenticatedUser identity; the admin crate wraps these in Axum extractors, cookie handling, and the rendered login screen.

Re-exports

pub use error::AuthError;

pub use migrations::migrations;

pub use migrations::MODULE_ID;

pub use permission::PermissionSet;

pub use service::AuthConfig;

pub use service::AuthService;

pub use service::AuthenticatedUser;

pub use service::IssuedSession;

pub use service::NewOperator;

pub use service::RequestContext;

Modules

error

Auth error taxonomy.

migrations

The auth schema, as portable migrations.

password

Argon2id password hashing.

permission

The permission model.

service

The authentication and authorization service.

store

Data access for the auth schema.

Structs

BackendUser

A backend user: an operator of the admin surface.

BackendUserSummary

A lightweight backend-user projection for listings (no credential fields).

Enums

AccessEvent

The kind of event recorded in the access log.