Module auth 

Local accounts (ADR-0021 § 2): the sessions login opens and the password hashes it checks. Their tables are crate::USERS_MIGRATION and crate::AUTH_MIGRATION, which puerto new --auth local writes into the project.

A session is an opaque token — 32 random bytes, base64url — and its row keeps only the token’s SHA-256. Revoking is a DELETE; there is no signing key to keep or rotate, and a lookup per request is the cost.

Structs

PgCredentials

credentials: one password hash per user.

PgSessions

sessions: a SessionStore for login and logout, and the Authenticator of a local project — the presented token’s hash, joined with its user. The roles are the users.roles column (make auth/grant).

Constants

DEFAULT_SESSION_TTL

How long a session lasts when AUTH_SESSION_TTL is not set.

Functions

generate_token

A new session token: 256 random bits, base64url without padding (43 characters).

parse_ttl

<n>d, <n>h or <n>m, n > 0.

session_ttl_from_env

AUTH_SESSION_TTL — 30d, 12h, 90m — or DEFAULT_SESSION_TTL when it is not set. A set but invalid value is an error: a startup error, not a silent default.

token_hash

What a session row keeps of its token.