parse_rust_auth/
lib.rs

1//! Sessions, roles and password hashing.
2//!
3//! What is here:
4//!
5//! - [`password`]: bcrypt hashing and verification, at upstream's cost factor and output format.
6//! - [`sessions`]: `_Session` rows. Token minting, resolution, duplicate destruction, revocation.
7//! - [`roles`]: the role graph, expanded from `_Role` and its two join collections.
8//!
9//! What is not here, and is not hidden behind a partial implementation: auth adapters and
10//! `authData` linking, MFA, password policy, account lockout, password reset, email verification,
11//! and the role cache. The crate name describes a subsystem; this list describes the crate.
12//!
13//! **Both [`sessions`] and [`roles`] read and write storage with no ACL and no CLP constraint.**
14//! That is not a shortcut, it is upstream's own design: `Auth.js` resolves a session token under
15//! `master(config)` (`Auth.js:168`) and expands roles under `master(this.config)`
16//! (`Auth.js:283`, `:383`). The reason is structural rather than a matter of convenience. A
17//! session lookup that respected the caller's ACL could not run at all, because until the lookup
18//! completes there is no caller to evaluate an ACL against. The same holds for the role graph:
19//! the role names are an *input* to every later access-control decision, so they cannot
20//! themselves be gated by one.
21//!
22//! The safety of that rests on the boundary being narrow. Nothing in this crate takes a
23//! client-supplied query. Every query it issues is built here from a session token, a user
24//! objectId or a set of role objectIds, and every row it returns is either consumed internally or
25//! reduced to a token, an id or a role name.
26//!
27//! Citations of the form `File.js:LINE` refer to parse-server at the pin recorded in `PIN` at the
28//! repository root.
29
30#![forbid(unsafe_code)]
31#![cfg_attr(
32    not(test),
33    deny(clippy::unwrap_used, clippy::expect_used, clippy::panic)
34)]
35
36pub mod password;
37pub mod roles;
38pub mod sessions;
39
40#[cfg(test)]
41mod testing;
42
43pub use roles::{expand_roles, RoleName, RolePrincipal};
44pub use sessions::{
45    create_session, ensure_session_schema, new_session_token, resolve_session, revoke,
46    revoke_all_for_user, CreatedSession, CreatedWith, NewSession, ResolvedSession, SessionAction,
47    SessionConfig, SESSION_TOKEN_PREFIX,
48};
parse_rust_auth/lib.rs

parse_rust_auth/
lib.rs
