webx_core/security/mod.rs
1//! Authentication/security extension points.
2//!
3//! Ports shared by application code and the HTTP host:
4//!
5//! * [`ITokenIssuer`] — mint a token from [`TokenClaims`] (login).
6//! * [`ISessionStore`] — revoke / query revoked tokens (logout, forced sign-out);
7//! the authentication middleware consults it after verifying a token.
8//! * [`IPasswordHasher`] — hash/verify passwords as PHC strings (Argon2id by
9//! default).
10//!
11//! # How the framework uses these ports
12//!
13//! The ports exist so business crates write "call the port" code, never crypto
14//! or session-plumbing code:
15//!
16//! * **Login** — a handler injects `Arc<dyn ITokenIssuer>`, calls
17//! [`ITokenIssuer::issue`], and returns `IssuedToken::token`. The password is
18//! checked with `Arc<dyn IPasswordHasher>` (`hash` on registration, `verify` on
19//! login, `needs_rehash` to upgrade old hashes).
20//! * **Authenticated requests** — the authentication middleware verifies the
21//! token, then (when an `ISessionStore` is registered) asks
22//! [`ISessionStore::is_revoked`] about the token's `jti`; revoked → 401.
23//! * **Logout** — the handler calls [`ISessionStore::revoke`] with the `jti` it
24//! stored (or received) at login; no wait for `exp` is needed.
25//!
26//! The traits are dependency-free so they can be implemented anywhere; the
27//! implementations that need third-party crates live in `rust-webx-host`
28//! (`JwtTokenIssuer`, `Argon2PasswordHasher`), while the ones that need nothing
29//! live here ([`InMemorySessionStore`]).
30
31mod password;
32mod session;
33mod tokens;
34
35pub use password::IPasswordHasher;
36pub use session::{ISessionStore, InMemorySessionStore};
37pub use tokens::{ITokenIssuer, IssuedToken, TokenClaims};