Crate sofie_identity 

Modules

account_data

Data export and account closing. Closing anonymizes rather than deletes, so records of other modules that name the account stay whole; AccountClosed tells those modules to erase what they hold.

impersonation

Signing in as a member, for a permitted principal of another area: each time recorded with its reason and raised as an event, the session it opens marked as such to the member and ended by itself after half an hour, and the impersonator signed back in at its end.

oauth

passkeys

sessions

testing

tokens

two_factor

Structs

Account

AddingMember

MemberAdded

An account made a member of an area from a task or a seed, as the first staff member of a Permitted area is, whose sign-up admits nobody to anything.

Membership

MembershipRemoved

A membership removed, and with sessions the account’s sessions in its area ended in the same commit, so a cookie open there stops at its next request.

Memberships

Password

Never printed or serialized, only hashed or checked; kept in NFC, as NIST SP 800-63B asks.

PasswordHash

Written as Argon2id in the PHC string format, $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>. pbkdf2-sha256$<iterations>$<salt>$<hash>, written before, is still read and checked.

Permitted

Its area’s routes reach every record, each only with its permission.

Role

RoleAssigned

A role given to an account whose address nobody proved, as add_member adopting one, distrusts it.

RoleGrant

Revoking deletes softly, keeping who had what.

SignInLocked

An app listens with #[on] to tell the owner.

SignedIn

Enums

PasswordCheck

Constants

FORMS

ROUTES

TRANSLATIONS

Traits

AccountArea

An area whose principal is an account itself, not a record it acts for such as an organization, so its account screens act on that account.

MemberArea

SignUp

Functions

add_member

An address no account holds gets one without a password, which signs in once its owner sets one (password-reset), follows a sign-in link or connects a provider. An account already a member keeps its membership, so adding it again changes nothing but a role. An account adopted, or given a role, whose address nobody proved may have been signed up by someone else expecting this, so it is distrusted.

add_member_task

For an app’s tasks: Tasks::new().task("sofie_identity.add_member", add_member_task), then <app> task sofie_identity.add_member --email … --area … [--role …].

assign_role

create_role

grant

Idempotent: a grant role already holds is returned unchanged. Checks nothing of who grants, so it is for seeds and boot; a handler grants with grant_as.

grant_as

Refuses a permission granter does not hold itself, so nobody widens a role past its own.

member

migrations

module

permitted_routes

Each route needs its sofie_identity.<model>.*.<action> permission.

remove_membership

Read and committed beyond the request’s reach, as an area’s principal seldom owns its members’ records. Without sessions, a session open in the area stays open until its cookie expires.

revoke

role_named

The role of that name, for a task or a seed naming one created before.

routes

Mounted in Web; sign-ins and sign-ups are rate-limited per address.

sign_in_for

Signs account in to an area whose principal is another of its records, such as an organization it belongs to; the session is listed as the account’s. The caller, an Admitter of its own, has checked that the account may act as principal.

worker

Type Aliases

AccountId

RoleId