Crate rustlavel_auth 

rustlavel-auth: sessions, API tokens, password hashing, CSRF, signed URLs.

Everything an application needs to know who is talking to it and to trust what they send. Like every rustlavel package it is opt-in: an application that never adds it never compiles a line of this.

use rustlavel_auth::prelude::*;

let sessions = SessionManager::from_config(&config, FileStore::new("storage/sessions"))?;
router.middleware(sessions);
router.middleware(Csrf::new());

router.group("/dashboard", |r| {
    r.middleware(Authenticate::from_config(&config));
    r.get("", |req: Request| async move {
        format!("hello, {}", req.identity().unwrap().id())
    });
});

Why the crypto crates are here

The framework builds from scratch on principle, and this crate follows that everywhere except the primitives: argon2, AES-GCM, HMAC and SHA-256 come from the RustCrypto crates. A hand-written cipher or KDF looks like it works from the first test and is a vulnerability regardless — this is the one place where writing less code is the safer engineering decision.

Re-exports

pub use csrf::Csrf;

pub use encryption::Encrypter;

pub use guard::AuthExt;

pub use guard::Authenticatable;

pub use guard::Authenticate;

pub use guard::Guard;

pub use guard::Guest;

pub use guard::Identity;

pub use hashing::Cost;

pub use hashing::hash_password;

pub use hashing::hash_password_with;

pub use hashing::needs_rehash;

pub use hashing::verify_password;

pub use impersonation::Impersonation;

pub use impersonation::ImpersonationExt;

pub use impersonation::Impersonator;

pub use key::AppKey;

pub use middleware::SessionExt;

pub use middleware::SessionHandle;

pub use middleware::SessionManager;

pub use session::Session;

pub use signed_url::SignatureError;

pub use signed_url::UrlSigner;

pub use store::FileStore;

pub use store::MemoryStore;

pub use store::SessionStore;

pub use store::SharedStore;

pub use tokens::MemoryTokenStore;

pub use tokens::NewToken;

pub use tokens::PlainTextToken;

pub use tokens::RequireApiToken;

pub use tokens::RequireScope;

pub use tokens::Scopes;

pub use tokens::SharedTokenStore;

pub use tokens::Token;

pub use tokens::TokenError;

pub use tokens::TokenExt;

pub use tokens::TokenStore;

Modules

base64

Base64 now lives in rustlavel-core, beside the other formats the framework writes for itself, so a crate that needs it — storage, for a Content-MD5 header — is not made to depend on the whole of auth. Every rustlavel_auth::base64::… path keeps working through this re-export.

csrf

The csrf middleware.

encryption

Authenticated encryption for anything the application hands to a client.

guard

Who is logged in: the guard, the auth middleware, and the guest one.

hashing

Password hashing with argon2id.

impersonation

Acting as another user, and getting back.

key

The application key, and the sub-keys derived from it.

middleware

The session middleware: cookie in, session out, and back again.

prelude

What a routes/web.rs or a controller imports to use this package.

qr

A QR Code encoder, byte mode, versions 1 to 10, to ISO/IEC 18004.

random

Random bytes, read straight from the operating system.

session

The session value: what is remembered about one visitor between requests.

signed_url

Signed URLs: links that prove they came from this application.

store

Where sessions live between requests.

tokens

API tokens: Authorization: Bearer <id>|<secret>, in Sanctum’s shape.

totp

Two-factor authentication: HOTP (RFC 4226) and TOTP (RFC 6238).

Enums

Error

Every failure the framework itself can produce.

Functions

constant_time_eq

Compare two byte strings without leaking where they first differ.

unix_now

The current time in unix seconds.

Type Aliases

Result

The framework-wide result type.