Struct PasswordAuthPlugin 

pub struct PasswordAuthPlugin { /* private fields */ }

Password auth plugin. Stores hashed passwords using Argon2id.

Passwords are hashed with Argon2id (the recommended variant for password hashing). The hash output is a PHC-format string that embeds the salt, algorithm, memory/time parameters, and hash value.

Implementations

impl PasswordAuthPlugin

pub fn new() -> Self

pub fn register( &self, email: &str, password: &str, user_id: &str, ) -> Result<(), String>

Register a new user with email + password.

pub fn verify(&self, email: &str, password: &str) -> Option<String>

Verify email + password. Returns the user_id if valid.

Timing-equalized: when the email is unknown we still run a throwaway Argon2 verify against a fixed dummy hash. Otherwise an attacker can distinguish “known email, wrong password” (takes ~50ms) from “unknown email” (<1ms) and enumerate registered addresses.

pub fn change_password( &self, email: &str, old_password: &str, new_password: &str, ) -> Result<(), String>

Change a user’s password.

pub fn is_registered(&self, email: &str) -> bool

Check if an email is registered.

pub fn reset_password( &self, email: &str, new_password: &str, ) -> Result<(), String>

Reset password (admin/magic-code flow — no old password needed).

Trait Implementations

impl Plugin for PasswordAuthPlugin

fn name(&self) -> &str

Unique name for this plugin.

fn on_init(&self, _ctx: &PluginContext)

Called once when the plugin is registered.

fn routes(&self) -> Vec<PluginRoute>

Custom API routes this plugin handles.

fn before_insert( &self, _entity: &str, _data: &mut Value, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity insert. Return Err to reject.

fn after_insert( &self, _entity: &str, _id: &str, _data: &Value, _auth: &AuthContext, )

Called after a successful insert.

fn before_update( &self, _entity: &str, _id: &str, _data: &mut Value, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity update. Return Err to reject.

fn after_update( &self, _entity: &str, _id: &str, _data: &Value, _auth: &AuthContext, )

Called after a successful update.

fn before_delete( &self, _entity: &str, _id: &str, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity delete. Return Err to reject.

fn after_delete(&self, _entity: &str, _id: &str, _auth: &AuthContext)

Called after a successful delete.

fn on_request( &self, _method: &str, _path: &str, _auth: &AuthContext, ) -> Result<(), PluginError>

Called on every incoming request (middleware).

fn on_request_with_meta( &self, method: &str, path: &str, auth: &AuthContext, _meta: &RequestMeta<'_>, ) -> Result<(), PluginError>

Richer variant of [on_request] that also receives per-request metadata (peer IP today; more fields may be added later). The default implementation delegates to on_request so existing plugins keep working without changes. Plugins that care about IP — notably rate limiting — override this hook.

fn on_session_create(&self, _user_id: &str, _token: &str)

Called when a new session is created.

fn entities(&self) -> Vec<ManifestEntity>

Additional manifest entities this plugin contributes.