Crate purwa_auth

Expand description

Authentication for Purwa: Argon2id passwords, tower-sessions + axum_login, and stubs for API tokens and struct-based policies.

§Escape hatches

Sessions: use session::memory_session_layer for dev; swap the store passed to tower_sessions::SessionManagerLayer::new for Redis or another backend. Handlers can use axum_login::AuthSession directly for full control.
Password cost: tune password::DEFAULT_M_COST_KIB / password::hash_password_with for production vs tests (password::hash_password_fast is for tests only).

AuthManagerLayerBuilder: Builder for the AuthManagerLayer.
AuthSession: A specialized session for identification, authentication, and authorization of users associated with a backend.
AuthzError: Authorization failure (minimal stub).
CurrentUser: Authenticated user: fails with 401 if the session has no user.
Gate: Gate carrying the current subject; extend with resource-specific checks.
MemoryStore: A session store that lives only in memory.
SessionManagerLayer: A layer for providing Session as a request extension.

DEFAULT_M_COST_KIB: Memory cost in kibibytes (KiB). OWASP suggests large values for production; ~19 MiB is a common baseline (19 * 1024 KiB).
DEFAULT_P_COST: Parallelism lanes.
DEFAULT_T_COST: Time cost (iterations).

ApiTokenStore: Resolve a raw secret token to a user identifier (e.g. database lookup of a hashed token).
AuthUser: A user which can be identified, authenticated, and authorized.
AuthnBackend: A backend which can authenticate users.
AuthzBackend: A backend which can authorize users.
Policy: Optional trait for richer policy objects.

argon2_default: Production-oriented Argon2id hasher.
argon2_fast: Low-cost hasher for tests.
authorization_bearer: Return the bearer token from Authorization: Bearer <token>, if present and well-formed.
hash_password: Hash a plaintext password to a PHC string ($argon2id$...) using default costs.
hash_password_fast: Hash with argon2_fast (tests / CI only).
hash_password_with: Hash using explicit Argon2 instance (e.g. argon2_fast in tests).
memory_session_layer: Build a SessionManagerLayer backed by in-memory storage (dev/tests; data lost on restart).
verify_password: Verify plain against a stored PHC string.
verify_password_with: Verify using the same Argon2 base as used for hashing; verification reads parameters from the PHC string, so this mainly selects algorithm/version.