Crate seamless_auth 

A Seamless Auth server adapter for Axum.

The adapter sits in front of the Seamless Auth API. Browsers talk to it over HttpOnly cookies on the application’s own domain, native clients over bearer tokens, and it talks to the auth API over bearer tokens and a service token. Which routes it serves, and what each does to the session, comes from the auth API’s adapter manifest.

use axum::{Json, Router, routing::get};
use seamless_auth::{Adapter, User};

let auth = Adapter::builder(std::env::var("AUTH_SERVER_URL")?)
    .cookie_secret(std::env::var("COOKIE_SECRET")?)
    .service_secret(std::env::var("SEAMLESS_SERVICE_TOKEN")?)
    .jwks_kid(std::env::var("JWKS_KID")?)
    .build()?;

let app: Router = Router::new()
    .route(
        "/api/me",
        get(|user: User| async move { Json(serde_json::json!({ "id": user.id })) })
            .route_layer(auth.require_auth()),
    )
    .nest("/auth", auth.router());

let listener = tokio::net::TcpListener::bind("0.0.0.0:8080").await?;
axum::serve(
    listener,
    app.into_make_service_with_connect_info::<std::net::SocketAddr>(),
)
.await?;

Structs

Adapter

Serves the Seamless Auth routes and guards the application’s own.

Builder

Configures an Adapter. Start one with Adapter::builder.

Delivery

A message the auth API hands back for the application to send.

InvalidProxy

A proxy address TrustedProxies::new could not read.

Manifest

The auth API’s adapter manifest (schemaVersion 1).

ManifestError

Why a manifest was refused.

ManifestRoute

One route an adapter serves.

PickBody

The fields of a response body a browser may see.

RequireAuth

The service RequireAuthLayer wraps around a handler.

RequireAuthLayer

The layer Adapter::require_auth returns.

TrustedProxies

Resolves the end user’s address for an app behind proxies with known addresses or subnets ("10.0.0.0/8", "127.0.0.1").

Unauthenticated

A request carried no valid session. Answers 401 {"error":"unauthenticated"}.

User

The session a request was authenticated with. RequireAuth puts it in the request extensions, and it is an extractor for handlers behind the guard.

Enums

BuildError

Why Builder::build refused its configuration.

SameSite

The SameSite attribute of the adapter’s cookies.

Constants

MANIFEST_PATH

Where the auth API publishes which token each route takes and which tokens its response issues or clears.

Type Aliases

DeliveryError

The error a delivery callback reports.