Crate rustlavel_auth

Expand description

rustlavel-auth: sessions, API tokens, password hashing, CSRF, signed URLs.

Everything an application needs to know who is talking to it and to trust what they send. Like every rustlavel package it is opt-in: an application that never adds it never compiles a line of this.

use rustlavel_auth::prelude::*;

let sessions = SessionManager::from_config(&config, FileStore::new("storage/sessions"))?;
router.middleware(sessions);
router.middleware(Csrf::new());

router.group("/dashboard", |r| {
    r.middleware(Authenticate::from_config(&config));
    r.get("", |req: Request| async move {
        format!("hello, {}", req.identity().unwrap().id())
    });
});

§Why the crypto crates are here

The framework builds from scratch on principle, and this crate follows that everywhere except the primitives: argon2, AES-GCM, HMAC and SHA-256 come from the RustCrypto crates. A hand-written cipher or KDF looks like it works from the first test and is a vulnerability regardless — this is the one place where writing less code is the safer engineering decision.

Re-exports§

pub use csrf::Csrf;
pub use encryption::Encrypter;
pub use guard::AuthExt;
pub use guard::Authenticatable;
pub use guard::Authenticate;
pub use guard::Guard;
pub use guard::Guest;
pub use guard::Identity;
pub use hashing::Cost;
pub use hashing::hash_password;
pub use hashing::hash_password_with;
pub use hashing::needs_rehash;
pub use hashing::verify_password;
pub use key::AppKey;
pub use middleware::SessionExt;
pub use middleware::SessionHandle;
pub use middleware::SessionManager;
pub use session::Session;
pub use signed_url::SignatureError;
pub use signed_url::UrlSigner;
pub use store::FileStore;
pub use store::MemoryStore;
pub use store::SessionStore;
pub use store::SharedStore;
pub use tokens::MemoryTokenStore;
pub use tokens::NewToken;
pub use tokens::PlainTextToken;
pub use tokens::RequireApiToken;
pub use tokens::RequireScope;
pub use tokens::Scopes;
pub use tokens::SharedTokenStore;
pub use tokens::Token;
pub use tokens::TokenError;
pub use tokens::TokenExt;
pub use tokens::TokenStore;

Modules§

base64: Base64, in both alphabets this crate needs.
csrf: The csrf middleware.
encryption: Authenticated encryption for anything the application hands to a client.
guard: Who is logged in: the guard, the auth middleware, and the guest one.
hashing: Password hashing with argon2id.
key: The application key, and the sub-keys derived from it.
middleware: The session middleware: cookie in, session out, and back again.
prelude: What a routes/web.rs or a controller imports to use this package.
random: Random bytes, read straight from the operating system.
session: The session value: what is remembered about one visitor between requests.
signed_url: Signed URLs: links that prove they came from this application.
store: Where sessions live between requests.
tokens: API tokens: Authorization: Bearer <id>|<secret>, in Sanctum’s shape.

Enums§

Error: Every failure the framework itself can produce.

Functions§

constant_time_eq: Compare two byte strings without leaking where they first differ.
unix_now: The current time in unix seconds.

Type Aliases§

Result: The framework-wide result type.