Module security 

Authentication/security extension points.

Ports shared by application code and the HTTP host:

• ITokenIssuer — mint a token from TokenClaims (login).
• ISessionStore — revoke / query revoked tokens (logout, forced sign-out); the authentication middleware consults it after verifying a token.
• IPasswordHasher — hash/verify passwords as PHC strings (Argon2id by default).

Two dependency-free primitives for the security-adjacent code every application writes at least once:

• constant_time_eq — compare secrets without leaking where they differ.
• OneTimeSecret — a TTL-bound secret consumed exactly once (installation token, invite link, password reset), with a OneTimeSecretState for telling 401 from 410.

How the framework uses these ports

The ports exist so business crates write “call the port” code, never crypto or session-plumbing code:

• Login — a handler injects Arc<dyn ITokenIssuer>, calls ITokenIssuer::issue, and returns IssuedToken::token. The password is checked with Arc<dyn IPasswordHasher> (hash on registration, verify on login, needs_rehash to upgrade old hashes).
• Authenticated requests — the authentication middleware verifies the token, then (when an ISessionStore is registered) asks ISessionStore::is_revoked about the token’s jti; revoked → 401.
• Logout — the handler calls ISessionStore::revoke with the jti it stored (or received) at login; no wait for exp is needed.

The traits are dependency-free so they can be implemented anywhere; the implementations that need third-party crates live in rust-webx-host (JwtTokenIssuer, Argon2PasswordHasher), while the ones that need nothing live here (InMemorySessionStore).

Structs

InMemorySessionStore

Process-local ISessionStore — the dependency-free default.

IssuedToken

A token minted by an ITokenIssuer.

OneTimeSecret

A TTL-bound secret that can be consumed at most once.

TokenClaims

Claims a caller hands to an ITokenIssuer.

Enums

OneTimeSecretState

Lifecycle of a OneTimeSecret slot.

Traits

IPasswordHasher

Hash and verify passwords (Argon2id by default).

ISessionStore

Revocation state for issued tokens.

ITokenIssuer

Mint a token from TokenClaims.

Functions

constant_time_eq

Compare two byte slices without returning early on a difference.