Crate pylon_auth 

Re-exports

pub use cookie::extract_token as extract_session_cookie;

pub use cookie::CookieConfig;

pub use cookie::SameSite;

Modules

cookie

Session cookie config + Set-Cookie header construction.

email

Pluggable email transport for auth flows (magic codes, invitations, etc.).

password

Argon2id password hashing + verification.

Structs

AuthContext

The auth context for a request. Represents who is making the request.

InMemoryOAuthBackend

In-memory backend (default). Lost on restart.

MagicCode

MagicCodeStore

An in-memory magic code store for development.

OAuthConfig

OAuthRegistry

OAuth provider registry.

OAuthState

OAuthStateStore

Stores OAuth state parameters to prevent CSRF attacks on the callback.

Session

A session token and its associated user.

SessionStore

A session store. In-memory by default; optionally backed by a persistent SessionBackend.

Enums

AuthMode

The auth mode declared on a route.

MagicCodeError

Traits

OAuthStateBackend

Backing store for OAuth state tokens. Default impl keeps them in memory (fine for tests + dev); the runtime swaps in a SQLite-backed impl so a restart in the middle of an OAuth handshake doesn’t leave the user with “invalid state” on the callback. Same pattern as SessionBackend.

SessionBackend

Pluggable storage backend for sessions. The default is in-memory; apps deploying for real should supply a persistent backend (e.g. SQLite or Redis) so users don’t log out on server restart.

Functions

constant_time_eq

Constant-time byte comparison to prevent timing attacks.