Struct AuthService 

pub struct AuthService { /* private fields */ }

The auth service. Cheap to clone: it holds a database handle and config.

Implementations

impl AuthService

pub fn new(db: Db, config: AuthConfig) -> Self

pub async fn authenticate( &self, username: &str, password: &str, ctx: &RequestContext, ) -> Result<IssuedSession, AuthError>

Verifies a username and password, and on success issues a session.

Failures are throttled per username and every outcome is logged. The error deliberately does not reveal whether the username exists.

pub async fn resolve_session( &self, token: &str, ) -> Result<ResolvedSession, AuthError>

Resolves a raw session token to an identity and its stored data blob, refreshing last-seen. Expired sessions, and sessions whose user was disabled or removed, resolve to AuthError::SessionInvalid. The blob is read in the same query as the session, adding no round-trip.

pub async fn verify_session( &self, token: &str, ) -> Result<AuthenticatedUser, AuthError>

Resolves a raw session token to an identity. A thin wrapper over AuthService::resolve_session for callers that need only the identity.

pub async fn set_session_data( &self, token: &str, data: &str, ) -> Result<(), AuthError>

Overwrites the opaque per-session data blob (the surface’s serialised state, e.g. CSRF token + flash). The surface writes only when its blob changed, so an unchanged request adds no write.

pub async fn logout(&self, token: &str) -> Result<(), AuthError>

Invalidates a session. Unknown tokens are a no-op.

pub async fn set_user_timezone( &self, user_id: i64, timezone: Option<&str>, ) -> Result<(), AuthError>

Persists an operator’s own display timezone. Some(name) sets an IANA timezone; None clears it so the operator falls back to the deployment default. Validating that name is a real timezone is the caller’s job.

pub async fn set_user_locale( &self, user_id: i64, locale: Option<&str>, ) -> Result<(), AuthError>

Persists an operator’s own UI locale. Some(tag) sets a base language tag; None clears it so the operator falls back to the deployment default. Validating that tag is a supported locale is the caller’s job.

pub async fn user_permission_overrides( &self, user_id: i64, ) -> Result<HashMap<String, i64>, AuthError>

Loads a user’s per-permission overrides (code to 1 allow or -1 deny).

pub async fn set_user_permissions( &self, user_id: i64, overrides: &HashMap<String, i64>, ) -> Result<(), AuthError>

Replaces a user’s per-permission overrides. Callers pass only 1 and -1 entries; an inherited permission is represented by its absence.

pub async fn record_audit(&self, entry: AuditEntry<'_>) -> Result<(), AuthError>

Appends an entry to the append-only audit log. Mutating admin paths call this after a successful change, so actions that affect privileges or data are recorded. Self-service preference changes are not audited.

pub async fn recent_audit( &self, limit: u64, ) -> Result<Vec<AuditRecord>, AuthError>

The most recent audit entries, newest first, for the admin audit view.

pub async fn has_any_operator(&self) -> Result<bool, AuthError>

Whether any backend operator exists yet. A fresh install with none is routed to first-run setup instead of login.

pub async fn create_superuser( &self, new: NewOperator<'_>, ) -> Result<i64, AuthError>

Creates a superuser operator: hashes the password, inserts the user, and records their timezone preference. The single account-creation path, shared by the CLI and the first-run setup screen.

Trait Implementations

impl Clone for AuthService

fn clone(&self) -> AuthService

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.