Module auth 

Who is calling: this server’s API tokens (bearer) and session cookies.

Players, tokens and sessions are the server’s own (chess.players, chess.api_tokens, chess.sessions). Tokens are hashed with SHA-256, with Lichess’s scope names (board:play, bot:play, challenge:read, challenge:write, email:read) plus chess:fairplay for reviewers. People make and revoke them on the Account page (crate::http::web), through the OAuth flow, or (for a host site’s players) through the site’s server (crate::http::web::esports_token). New tokens start ocp_; tokens imported from a host site keep its esl_. A short cache keeps a busy game from hitting the database for every move; a revoked token stops working within CACHE_TTL.

Staff. A player’s roles here (admin; manager) are this server’s alone. Their rights need a passkey check as well, made in the session or with the token in hand (crate::passkeys), which lasts CHESS_ADMIN_PASSKEY_HOURS; until then the identity is only pending.

Partners. Other services (a host site) call with a partner token (ocs_), which an admin makes; its scopes say what it may do: PARTNER_READ (games, players, the feed) and PARTNER_SITE (the host site’s endpoints: its players’ tokens and links). The host site’s shared secret (ESPORTS_SECRET) still works as a partner with both, so a site can move to a partner token at its own pace.

Structs

Auth

Identity

Partner

A partner calling (another service), or the host site’s shared secret.

Constants

CACHE_TTL

PARTNER_PREFIX

Partner tokens’ prefix.

PARTNER_READ

Partner scope: read games, players and the feed.

PARTNER_SCOPES

PARTNER_SITE

Partner scope: the host site’s endpoints (/api/esports/…).

SCOPES

Scopes this server understands (Lichess’s names, and one of ours).

SESSION_COOKIE

Signed in to this server (its own sign-in, or with the host site).

SITE_TOKEN_PREFIX

Tokens imported from a host site (esports-lab) keep its prefix.

TOKEN_PREFIX

New tokens’ prefix.

Functions

bearer

cookie

hash_key

random_token

same

Compare secrets in constant time.

staff_roles

An admin’s or manager’s roles, as stored.