sz_orm_auth/
lib.rs

1//! # SZ-ORM Auth — 认证授权
2//!
3//! 提供 JWT 令牌签发/校验与基于 RBAC 的权限控制（`Authorizer`/`RbacAuthorizer`），
4//! 涵盖用户、凭证与角色权限模型。
5//!
6//! ## 主要模块
7//!
8//! - [`auth`] — 用户、凭证等基础模型
9//! - [`jwt`] — JSON Web Token 签发与校验
10//! - [`authorizer`] — RBAC 授权器（含角色层级）
11//! - [`oauth2`] — OAuth2 授权码流程（RFC 6749）
12//! - [`mfa`] — 多因素认证（TOTP, RFC 6238）
13//! - [`token_store`] — 刷新令牌存储（轮换 + 撤销 + 重放检测）
14
15pub mod auth;
16pub mod authorizer;
17pub mod error;
18pub mod jwt;
19pub mod mfa;
20pub mod oauth2;
21pub mod token_store;
22
23pub use auth::*;
24pub use authorizer::{Authorizer, RbacAuthorizer};
25pub use error::AuthError;
26pub use mfa::{MfaManager, MfaSecret, TotpVerifier};
27pub use oauth2::{AuthorizationCode, AuthorizationRequest, OAuth2Server, TokenRequest};
28pub use token_store::{StoredToken, TokenFamilyError, TokenStore};
29
30#[cfg(test)]
31mod tests {
32    use super::*;
33
34    /// 测试用密码验证器（H-1 修复后 authenticate 必须配置 verifier）
35    struct MockVerifier;
36    impl auth::PasswordVerifier for MockVerifier {
37        fn verify_password(&self, _u: &str, _p: &str) -> Result<i64, AuthError> {
38            Ok(42)
39        }
40    }
41
42    #[test]
43    fn test_module_exports() {
44        // Smoke test ensuring the public API compiles and is reachable.
45        let creds = Credentials::new("user", "pass");
46        assert_eq!(creds.username, "user");
47    }
48
49    #[test]
50    fn test_rbac_authorizer_via_lib_root() {
51        let authorizer = RbacAuthorizer::new();
52        let user = User::new(1, "user").with_permissions(vec!["read".to_string()]);
53
54        let can_read = authorizer.can(&user, "read", "resource");
55        let can_delete = authorizer.can(&user, "delete", "resource");
56
57        assert!(can_read.unwrap());
58        assert!(!can_delete.unwrap());
59    }
60
61    #[test]
62    fn test_rbac_authorizer_admin_via_lib_root() {
63        let authorizer = RbacAuthorizer::new();
64        let user = User::new(1, "admin").with_roles(vec!["admin".to_string()]);
65
66        let can_do_anything = authorizer.can(&user, "delete", "anything");
67
68        assert!(can_do_anything.unwrap());
69    }
70
71    #[test]
72    fn test_jwt_authenticator_via_lib_root() {
73        // v1.2.1 H-1 修复：authenticate 必须配置 password_verifier
74        let auth = JwtAuthenticator::new("secret", "issuer", 3600)
75            .with_password_verifier(std::sync::Arc::new(MockVerifier));
76        let creds = Credentials::new("user", "pass");
77
78        let token = auth.authenticate(&creds).expect("authenticate");
79        assert!(!token.access_token.is_empty());
80
81        let user = auth.verify_token(&token.access_token).expect("verify");
82        assert_eq!(user.username, "user");
83        assert_eq!(user.id, 42);
84    }
85
86    #[test]
87    fn test_jwt_encoder_via_lib_root() {
88        use jwt::{JwtClaims, JwtEncoder};
89        let encoder = JwtEncoder::new("lib-secret");
90        let claims = JwtClaims::new("lib-user", 9_999_999_999);
91        let token = encoder.encode(&claims).expect("encode");
92        let decoded = encoder.decode(&token).expect("decode");
93        assert_eq!(decoded.sub, "lib-user");
94    }
95}
sz_orm_auth/lib.rs

sz_orm_auth/
lib.rs
