Module auth 

Authentication primitives: extractors, middleware, password hashing, token generation, and session helpers.

Structs

CurrentUser

Information about the currently authenticated user, attached to handlers that opt in to the CurrentUser extractor.

LslBearer

Bearer-token guard for the LSL-facing registration endpoint. Constant- time-compares against the configured shared secret.

Functions

create_session

Insert a fresh session for the given user and produce the signed cookie to set on the response.

delete_session

Delete a session row by the raw 32-byte id from the cookie. Used on logout. Hashes internally so callers continue to pass cookie bytes.

generate_session_id

Generate a fresh 32-byte session id. The id is what goes into the cookie (base64-encoded, then signed) and what we look up in the sessions table.

generate_token

Generate a fresh 32-byte random token and return both the raw bytes (to be base64-encoded into the link) and the SHA-256 hash (to be stored in the DB).

hash_password

Hash a password using Argon2id with default parameters and a fresh random salt.

hash_token

Hash an incoming token string (the one carried in the URL) so it can be looked up in the set_password_tokens table.

lookup_user_by_identifier

Look up a user row by identifier. Tries (in order): UUID parse, firstname.lastname username, “Firstname Lastname” legacy name. Used by both the login flow and the invitation creation flow, which is why it lives here in auth.rs rather than in a route module.

removal_cookie

Build a removal cookie that clears the session on the client.

require_session

Middleware that enforces a valid session on the wrapped routes.

run_cleanup

Background task that prunes expired sessions and set-password tokens. Spawned alongside the existing job evictor in bin/sl_map_web.rs.

session_id_from_jar

Look up the raw session id from the cookie jar of the current request. Returns None if there is no cookie or the cookie does not decode.

uuid_from_bytes

Convert a 16-byte SQLite BLOB back into a Uuid. Returns None if the blob is the wrong length.

verify_password

Verify a password against a PHC-encoded Argon2 hash. Returns Ok(false) on mismatch and Ok(true) on match.

Type Aliases

SessionRow

(user_id_bytes, legacy_name, username, sessions.expires_at) — the columns selected in the CurrentUser extractor’s session/user join.

SetPasswordTokenRow

(user_id_bytes, expires_at, used_at) — columns selected when looking up a set-password token.

UserRow

(user_id_bytes, legacy_name, username, password_hash) — the four columns returned by every users lookup variant.