laterite_auth/lib.rs
1//! Laterite auth: backend user authentication and authorization.
2//!
3//! Provides the operator-facing security primitives the admin surface is
4//! built on: Argon2id password hashing, opaque server-side sessions, a
5//! role-based permission model over dotted permission strings, brute-force
6//! throttling, and an append-only access log. "Backend users" are the
7//! operators of the admin, kept distinct from any application's end users.
8//!
9//! This crate is HTTP-agnostic on purpose. It exposes an [`AuthService`] with
10//! plain async methods (`authenticate`, `verify_session`, `logout`) plus an
11//! [`AuthenticatedUser`] identity; the admin crate wraps these in Axum
12//! extractors, cookie handling, and the rendered login screen.
13
14pub mod audit_listener;
15pub mod error;
16pub mod migrations;
17pub mod password;
18pub mod permission;
19pub mod service;
20pub mod store;
21
22/// The built-in role every administrative permission belongs to. Held by the
23/// first operator, and by anyone who should administer the panel itself.
24pub const ROLE_ADMIN: &str = "admin";
25
26/// The built-in role for working with content rather than the panel. Empty on a
27/// bare framework: a permission joins it by naming it.
28pub const ROLE_EDITOR: &str = "editor";
29
30mod models;
31mod schema;
32
33pub use audit_listener::AuditListener;
34pub use error::AuthError;
35pub use migrations::{migrations, MODULE_ID};
36pub use models::{AccessEvent, BackendUser, BackendUserSummary};
37pub use permission::PermissionSet;
38pub use service::{
39 ActiveSession, AuditEntry, AuthConfig, AuthService, AuthenticatedUser, IssuedSession,
40 NewOperator, RecalledSession, RememberCredential, RequestContext, ResolvedSession,
41 MIN_PASSWORD_LENGTH,
42};
43pub use store::AuditRecord;
44pub use store::{RevokeReason, SessionEnd};
45
46/// The `laterite.auth` module: the framework's backend-user auth tables.
47pub struct AuthModule;
48
49impl laterite_core::Module for AuthModule {
50 fn id(&self) -> laterite_core::ModuleId {
51 laterite_core::ModuleId::new(MODULE_ID)
52 }
53 fn migrations(&self) -> laterite_core::MigrationSet {
54 migrations()
55 }
56 fn register(&self, registry: &mut laterite_core::Registry) {
57 registry.add(laterite_core::ModelListenerReg::all(std::sync::Arc::new(
58 audit_listener::AuditListener,
59 )));
60 }
61}