tablo_core/auth/config.rs
1//! [`Auth`]: the panel's authentication configuration, from the authenticator to the pages and
2//! mail it adds.
3
4use std::marker::PhantomData;
5
6use super::{
7 AdminUser, AuthMail, Authenticator, DynAuthenticator, EmailVerification, LoginThrottle,
8 PanelUser, PasswordAuth, PasswordReset, ProfileEditor, Registrar, TenantEditor,
9 TenantRegistration, TwoFactor, profile::DynProfileEditor, registration::DynRegistrar,
10 tenant_profile::DynTenantEditor,
11};
12
13/// The panel's authentication configuration (ADR-0013).
14///
15/// The default is [`Auth::password`]; [`Auth::custom`] installs an app-owned
16/// [`Authenticator`]; [`Auth::disabled`] is the explicit fail-open opt-out.
17/// Sign-in attempts are throttled per login and address by default; see [`Auth::throttle`].
18/// [`Auth::account_throttle`] adds an opt-in count per login across addresses.
19/// [`Auth::registration`] adds a sign-up page, [`Auth::profile`] a profile page, and
20/// [`Auth::password_reset`] a forgot-password page that mails reset links through
21/// [`Auth::mail`], [`Auth::tenant_registration`] a page creating a tenant, and
22/// [`Auth::tenant_profile`] a page editing one.
23///
24/// `U` is the user type the authenticator loads. Every seam that reads or writes a user, from the
25/// registrar to the tenant editor, names the same type, so a seam over another user type does not
26/// compile.
27pub struct Auth<U = AdminUser> {
28 config: AuthConfig,
29 user: PhantomData<fn() -> U>,
30}
31
32impl Auth {
33 /// The shipped Argon2id + [`AdminUser`] authenticator.
34 #[must_use]
35 pub fn password() -> Self {
36 Self::custom(PasswordAuth)
37 }
38
39 /// Explicit fail-open opt-out for public demos (ADR-0013): no gate, no
40 /// login routes, sessions unused.
41 #[must_use]
42 pub fn disabled() -> Self {
43 Self::new(AuthConfig {
44 authenticator: None,
45 throttle: LoginThrottle::off(),
46 account_throttle: LoginThrottle::off(),
47 registrar: None,
48 sign_up_throttle: LoginThrottle::off(),
49 profile_editor: None,
50 profile_throttle: LoginThrottle::off(),
51 reset: None,
52 mail: None,
53 verification: None,
54 tenant_registration: None,
55 tenant_editor: None,
56 two_factor: None,
57 })
58 }
59}
60
61impl<U: PanelUser> Auth<U> {
62 /// An app-owned authenticator over its own user table.
63 #[must_use]
64 pub fn custom<A: Authenticator<User = U>>(authenticator: A) -> Self {
65 Self::new(AuthConfig {
66 authenticator: Some(Box::new(authenticator)),
67 throttle: LoginThrottle::default(),
68 account_throttle: LoginThrottle::off(),
69 registrar: None,
70 sign_up_throttle: LoginThrottle::default(),
71 profile_editor: None,
72 profile_throttle: LoginThrottle::default(),
73 reset: None,
74 mail: None,
75 verification: None,
76 tenant_registration: None,
77 tenant_editor: None,
78 two_factor: None,
79 })
80 }
81
82 fn new(config: AuthConfig) -> Self {
83 Self {
84 config,
85 user: PhantomData,
86 }
87 }
88
89 /// How many sign-in attempts one login may make from one client address
90 /// in a window; defaults to five a minute. [`LoginThrottle::off`] counts nothing, for a proxy
91 /// that limits sign-ins itself.
92 #[must_use]
93 pub fn throttle(mut self, throttle: LoginThrottle) -> Self {
94 self.config.throttle = throttle;
95 self
96 }
97
98 /// How many sign-in attempts one login may make from all addresses together in a window;
99 /// off by default. It stops a guesser who rotates addresses, at the cost of letting anyone
100 /// who knows a login refuse its owner until the window ends, again each window; a successful
101 /// sign-in clears it. Turn it on where a guessed password costs more than a locked-out
102 /// owner, with a limit high enough that only a distributed guesser reaches it, such as
103 /// `LoginThrottle::new(50, Duration::from_hours(1))`.
104 #[must_use]
105 pub fn account_throttle(mut self, throttle: LoginThrottle) -> Self {
106 self.config.account_throttle = throttle;
107 self
108 }
109
110 /// Lets visitors create their own account at `{prefix}/register`, through `registrar`; the
111 /// login page links to it.
112 ///
113 /// ```rust
114 /// use tablo_core::{Auth, PasswordSignUp};
115 ///
116 /// let auth = Auth::password().registration(PasswordSignUp::pending());
117 /// # let _ = auth;
118 /// ```
119 ///
120 /// [`PasswordSignUp`](crate::PasswordSignUp) registers an [`AdminUser`](super::AdminUser) from
121 /// a [`SignUp`](super::SignUp), inactive until an administrator approves it or, when built
122 /// with `open`, active and signed in at once. A custom [`Registrar`] decides what a new
123 /// account may do; one whose user may not access the panel lands on the login page.
124 ///
125 /// - The form is any `FormInput`, or the shipped `SignUp`. `#[form(password)]` renders a masked
126 /// control, with a button that shows what was typed, that a refused form renders empty, and
127 /// reads the password as typed, outer spaces included, as the login compares it.
128 /// `#[form(email)]` refuses a malformed address before `validate` runs. A missing field and a
129 /// malformed value answer 422 with the error under the field, as `validate`'s refusals do;
130 /// nothing is written.
131 /// - `new_password_errors` refuses a password under eight characters and a confirmation that
132 /// differs, under the `password` and `password_confirmation` keys.
133 /// - After the commit, an account that may open the panel is signed in, its session rotated as
134 /// a login rotates it, and lands on `next` or the panel's home page. One that may not, such
135 /// as an account awaiting approval, lands on the login page with a notification instead. A
136 /// signed-in user who opens the sign-up page lands on the panel's home page.
137 /// - The registrar's `User` is `U`. Mounting refuses a registration on `Auth::disabled()`, a
138 /// form field named `csrf_token` or `next`, a file field and a relationship choice, whose
139 /// options would list records to a visitor nobody signed in.
140 /// - Throttling. Each client address may submit five sign-ups a minute, counted whether or not
141 /// they create an account; `Auth::sign_up_throttle` changes the limit. Past it the page
142 /// answers 429.
143 ///
144 /// The sign-up page tells a visitor whether an email is taken, which the login page never does:
145 /// an app that must keep its accounts private verifies the address by email before saying so,
146 /// which Tablo does not ship.
147 #[must_use]
148 pub fn registration(mut self, registrar: impl Registrar<User = U>) -> Self {
149 self.config.registrar = Some(Box::new(registrar));
150 self
151 }
152
153 /// How many sign-ups one client address may submit in a window; defaults to five a minute.
154 /// Every sign-up POST that passes the CSRF check and parses counts, whether or not it creates
155 /// an account.
156 #[must_use]
157 pub fn sign_up_throttle(mut self, throttle: LoginThrottle) -> Self {
158 self.config.sign_up_throttle = throttle;
159 self
160 }
161
162 /// Lets the signed-in user edit their own account at `{prefix}/profile`, through `editor`;
163 /// the user menu links to it.
164 ///
165 /// ```rust
166 /// use tablo_core::{Auth, PasswordAuth};
167 ///
168 /// let auth = Auth::password().profile(PasswordAuth);
169 /// # let _ = auth;
170 /// ```
171 ///
172 /// [`PasswordAuth`] edits an [`AdminUser`](super::AdminUser)'s name, email and password through
173 /// a [`Profile`](super::Profile), asking for the current password before the email or the
174 /// password changes.
175 ///
176 /// - The form is any `FormInput`, rendered in the panel's shell. The page shows what the
177 /// input's `write` writes, so `Profile` never shows a password. A disabled control keeps what
178 /// `fill` wrote, whatever the POST carries. A refused save renders the form again with each
179 /// error under its field; nothing is written.
180 /// - `save` answers `ProfileUpdate::Details`, which keeps every session, or
181 /// `ProfileUpdate::Credentials` for a change to what the user signs in with. The user's
182 /// sessions then end on every panel whose authenticator loads the same user type, in the
183 /// transaction that saves, and the browser that saved gets a new session under the tenant it
184 /// acted for. `PasswordAuth` answers `Credentials` for a new email or password.
185 /// - An email another account holds is reported only once the current password verifies, so a
186 /// stolen session cannot probe which addresses have accounts.
187 /// - After the commit the page reloads with a notification.
188 /// - The editor's `User` is `U`. Mounting refuses a profile on `Auth::disabled()`, a form field
189 /// named `csrf_token`, a file field and a relationship choice, whose options no route serves
190 /// the page.
191 /// - Throttling. Each user may submit five saves a minute, from any address, counted whether or
192 /// not they save; `Auth::profile_throttle` changes the limit. Past it the page answers 429,
193 /// which keeps a stolen session from guessing the current password. A user past the limit can
194 /// still sign in.
195 #[must_use]
196 pub fn profile(mut self, editor: impl ProfileEditor<User = U>) -> Self {
197 self.config.profile_editor = Some(Box::new(editor));
198 self
199 }
200
201 /// How many profile saves one user may submit in a window, from any address; defaults to five
202 /// a minute. Every profile POST that passes the CSRF check and parses counts, whether or not
203 /// it saves.
204 #[must_use]
205 pub fn profile_throttle(mut self, throttle: LoginThrottle) -> Self {
206 self.config.profile_throttle = throttle;
207 self
208 }
209
210 /// Lets a visitor who forgot their password ask for a reset link at
211 /// `{prefix}/forgot-password`, mailed through [`Auth::mail`], and choose a new password at
212 /// `{prefix}/reset-password`; the login page links to it.
213 ///
214 /// - The request page answers the same whether an account uses the address or not: it redirects
215 /// to the login page with a notification, and writes and mails the link after answering, so
216 /// the database and the mail server add no time when an account exists. An account that may
217 /// not enter the panel gets no link, and a failed send is logged, not shown.
218 /// - The link goes to the stored address, never the typed one. A lookup that matches loosely,
219 /// such as a collation that folds accents, would otherwise mail one account's link to another
220 /// address.
221 /// - A link works once, for one hour, on the panel that mailed it, and only while the account
222 /// may still enter the panel. A new request replaces the account's earlier link, and a
223 /// password change on the profile page ends it, as it ends every link the account holds. The
224 /// token is stored only as a hash, and the reset page sends no referrer and may not be
225 /// cached.
226 /// - A reset checks the new password with `new_password_errors`, then sets it, ends the
227 /// account's sessions and reset links on every panel whose authenticator loads the same user
228 /// type, and redirects to the login page. All of this commits in one transaction.
229 /// - Throttling. Each address may request three links in fifteen minutes, from any client,
230 /// counted whether or not an account uses it; `PasswordReset::throttle` changes the limit.
231 /// Past it the page answers 429. A limit per client belongs at the proxy.
232 /// - The resetter's `User` is `U`. Mounting refuses a reset on `Auth::disabled()`, a reset
233 /// without `Auth::mail`, a base URL that is not an absolute `http` or `https` URL or that
234 /// carries a query or fragment, and a router without a `MailConfig`.
235 #[must_use]
236 pub fn password_reset(mut self, reset: PasswordReset<U>) -> Self {
237 self.config.reset = Some(reset.erase());
238 self
239 }
240
241 /// Makes each signed-in user prove they read the address [`PanelUser::email`] answers before
242 /// they reach anything but `{prefix}/verify-email`, which mails them a link through
243 /// [`Auth::mail`]. A sign-up mails the link at once, after the response.
244 ///
245 /// - Until the user verifies, a page redirects to `{prefix}/verify-email` and any other request
246 /// answers 403. The page offers to mail a link, and to sign out. A user whose
247 /// `PanelUser::email` is `None` has no address to prove and is not held.
248 /// - Accounts that predate verification are unverified: turning it on sends each of them,
249 /// seeded admins included, to `{prefix}/verify-email` at their next request. Backfill
250 /// `email_verified_at` (from `created_at`, say) for the addresses you already trust.
251 /// - A link works once, for one day, on the panel that mailed it, and only while the account
252 /// may enter the panel and still stores the address it was mailed to. It verifies on `GET` in
253 /// any browser, signed in or not, then lands on the panel or on the login page. A mail
254 /// scanner that opens the link verifies the address too: it fetched the link from the mailbox
255 /// the link proves.
256 /// - A new email waits for its own link. A profile editor calls `auth::request_email_change`
257 /// from `save` in place of writing the address: on a panel with email verification it records
258 /// the change and answers `EmailChange::Pending`, and once the save commits the panel mails
259 /// the new address a link that stores it and the old address a link that keeps it. Elsewhere
260 /// it answers `EmailChange::Immediate` and the editor stores the address itself.
261 /// `PasswordAuth` does this. The link proves only that whoever asked reads the new mailbox,
262 /// so ask for the current password before calling it, as `PasswordAuth` does: a stolen
263 /// session could name its thief's mailbox.
264 /// - Either link opens a page whose button does the work, so a mail scanner that fetches it
265 /// changes nothing.
266 /// - The new address's link stores it, verified, once, for one day. It is a credential change:
267 /// the account's sessions and sign-in links end on every panel signing in its user type, and
268 /// the browser that confirmed keeps a new session when it was signed in as the account.
269 /// - The old address's link works for a week, before or after the change goes through: it keeps
270 /// the old address, restoring it if the change went through, and ends every session, sign-in
271 /// link and pending change the account holds, the cancelling browser's included: whoever
272 /// asked for the change may hold one.
273 /// - Throttling. Each account may ask for three links in fifteen minutes;
274 /// `EmailVerification::throttle` changes the limit. Past it the page answers 429.
275 /// - The verifier's `User` is `U`. Mounting refuses a verification on `Auth::disabled()`, and
276 /// one without `Auth::mail`.
277 ///
278 /// [`PanelUser::email`]: super::PanelUser::email
279 #[must_use]
280 pub fn email_verification(mut self, verification: EmailVerification<U>) -> Self {
281 self.config.verification = Some(verification.erase());
282 self
283 }
284
285 /// Lets the signed-in user create a tenant to act for at `{prefix}/register-tenant`, through
286 /// `registration`'s [`TenantRegistrar`](super::TenantRegistrar); the tenant menu links to
287 /// it from one membership on. [`TenantRegistration::required`] sends a user who acts for no
288 /// tenant there first.
289 ///
290 /// The registrar's `Input` is the page's form; `validate` and `register` run in one
291 /// transaction, and `register` writes the tenant and the user's membership of it, answering
292 /// that [`Membership`](crate::Membership). The session then acts for the new tenant, and the
293 /// next request's [`find_by_id`](crate::Authenticator::find_by_id) must list it.
294 ///
295 /// The registrar's [`User`](super::TenantRegistrar::User) is `U`. Mounting refuses a
296 /// registration on [`Auth::disabled`], a form field named `csrf_token`, a file field and a
297 /// relationship choice.
298 #[must_use]
299 pub fn tenant_registration(mut self, registration: TenantRegistration<U>) -> Self {
300 self.config.tenant_registration = Some(registration.erase());
301 self
302 }
303
304 /// Lets the signed-in user edit the tenant they act for at `{prefix}/tenant/profile`, through
305 /// `editor`; the tenant menu links to it for a user [`TenantEditor::may_edit`] admits, and the
306 /// page answers 403 to anyone else. `fill` loads the form from the tenant, and `validate` and
307 /// `save` run in one transaction. The form names the tenant it was filled from, so one posted
308 /// after another tab switched tenants saves nothing.
309 ///
310 /// The editor's [`User`](TenantEditor::User) is `U`. Mounting refuses a settings page on
311 /// [`Auth::disabled`], a form field named `csrf_token` or `editing_tenant`, a file field and a
312 /// relationship choice.
313 #[must_use]
314 pub fn tenant_profile(mut self, editor: impl TenantEditor<User = U>) -> Self {
315 self.config.tenant_editor = Some(Box::new(editor));
316 self
317 }
318
319 /// Lets each signed-in user add an authenticator app at `{prefix}/two-factor`; the user menu
320 /// links to it. An account with one signs in with a code from it, or a recovery code, at
321 /// `{prefix}/two-factor-challenge` after its password.
322 ///
323 /// - Setting up happens at `{prefix}/two-factor`, which the user menu links to. It asks for the
324 /// current password first, through `Authenticator::confirm_password`, so a stolen session
325 /// cannot add a factor its thief holds. That method verifies with the user's
326 /// `PanelUser::email` as the login; override it when users sign in with something else. The
327 /// page then shows a QR code and the key, and turns two-factor sign-in on once a code from
328 /// the app matches. It then shows eight recovery codes, once: the panel stores only their
329 /// hashes, keyed like the secrets.
330 /// - Each panel enrols apart. A factor signs in to the panel that set it up only, even when
331 /// other panels load the same user type: enrol on each.
332 /// - Signing in, a correct password leads to `{prefix}/two-factor-challenge` instead of a
333 /// session. The challenge lasts five minutes in its own cookie and takes a code from the app
334 /// or a recovery code. Each code works once: an app code does not sign in twice, and a
335 /// recovery code is used up.
336 /// - Wrong codes. Every fifth wrong code in a row ends the challenge, so the next try takes the
337 /// password again. Past the fifth, each code of the app or the mail waits for the one before
338 /// it: 30 seconds, doubling up to an hour, across challenges, until a right code; a recovery
339 /// code never waits. Each fifth mails the account, through `Auth::mail`, that its password
340 /// signed in and codes failed. Someone holding the password can so keep the app's codes
341 /// waiting and make the owner spend recovery codes; the mail tells the owner, and a new
342 /// password ends it.
343 /// - Turning it on or off is a credential change: the account's other sessions and links end.
344 /// Turning it off, and showing new recovery codes, take a code.
345 /// - Codes by email. `TwoFactor::new().email_codes()` lets a user with an address choose codes
346 /// mailed to it in place of an app, through `Auth::mail`. Each sign-in mails a six-digit code
347 /// that works once, for ten minutes; the challenge page mails a new one on request, in place
348 /// of the last. Each account may have three mailed in fifteen minutes;
349 /// `TwoFactor::mail_throttle` changes the limit. An account holds one factor at a time: it
350 /// turns one off before setting up the other. A panel that drops `email_codes()` mails no
351 /// more codes: an account set up for them signs in with a recovery code. A mail server that
352 /// fails leaves the challenge up, with its button to send another code.
353 /// - Throttling. Each account may try five codes or passwords a minute, at sign-in and on the
354 /// settings page together; `TwoFactor::throttle` changes the limit. Past it the page answers
355 /// 429. The count lives in each process: behind several, the limit holds per process. Someone
356 /// who knows the password can use up the owner's attempts, and each new sign-in replaces the
357 /// last challenge.
358 /// - The cookie `Key` seals the secrets. Rotating it makes every app code fail until its owner
359 /// signs in with a recovery code and sets the app up again; a leaked key opens every secret.
360 /// - Requiring it. `TwoFactor::new().required()` sends a signed-in user without a second factor
361 /// to `{prefix}/two-factor` before anything else, as an unverified address does: a page
362 /// redirects there and any other request answers 403.
363 /// - Mounting refuses two-factor sign-in on `Auth::disabled()`, a router without a cookie
364 /// `Key`, and codes by email without `Auth::mail`.
365 #[must_use]
366 pub fn two_factor(mut self, two_factor: TwoFactor) -> Self {
367 self.config.two_factor = Some(two_factor);
368 self
369 }
370
371 /// Sends the panel's auth mail, such as reset links, from `mail`'s sender, with links that
372 /// start with its base URL. Mounting refuses a base URL that is not absolute, and a router
373 /// without a [`MailConfig`](topcoat::mail::MailConfig).
374 #[must_use]
375 pub fn mail(mut self, mail: AuthMail) -> Self {
376 self.config.mail = Some(mail);
377 self
378 }
379
380 /// Whether the explicit opt-out is set.
381 #[must_use]
382 pub fn is_disabled(&self) -> bool {
383 self.config.is_disabled()
384 }
385
386 /// The declaration, its user type checked.
387 pub(crate) fn into_config(self) -> AuthConfig {
388 self.config
389 }
390}
391
392impl Default for Auth {
393 fn default() -> Self {
394 Self::password()
395 }
396}
397
398impl<U> std::fmt::Debug for Auth<U> {
399 fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
400 self.config.fmt(f)
401 }
402}
403
404/// What an [`Auth`] declares, with the user type erased once the builder has checked it.
405pub(crate) struct AuthConfig {
406 authenticator: Option<Box<dyn DynAuthenticator>>,
407 throttle: LoginThrottle,
408 account_throttle: LoginThrottle,
409 pub(super) registrar: Option<Box<dyn DynRegistrar>>,
410 sign_up_throttle: LoginThrottle,
411 pub(super) profile_editor: Option<Box<dyn DynProfileEditor>>,
412 profile_throttle: LoginThrottle,
413 pub(super) reset: Option<PasswordReset<()>>,
414 pub(super) mail: Option<AuthMail>,
415 pub(super) verification: Option<EmailVerification<()>>,
416 pub(super) tenant_registration: Option<TenantRegistration<()>>,
417 pub(super) tenant_editor: Option<Box<dyn DynTenantEditor>>,
418 pub(super) two_factor: Option<TwoFactor>,
419}
420
421impl AuthConfig {
422 /// Whether the explicit opt-out is set.
423 pub(crate) fn is_disabled(&self) -> bool {
424 self.authenticator.is_none()
425 }
426
427 /// The authenticator, or `None` when auth is disabled.
428 pub(crate) fn authenticator(&self) -> Option<&dyn DynAuthenticator> {
429 self.authenticator.as_deref()
430 }
431
432 /// The sign-in throttle.
433 pub(crate) fn login_throttle(&self) -> &LoginThrottle {
434 &self.throttle
435 }
436
437 /// The sign-in throttle counted per login across addresses.
438 pub(crate) fn account_throttle_of(&self) -> &LoginThrottle {
439 &self.account_throttle
440 }
441
442 /// The registrar, or `None` without a sign-up page.
443 pub(crate) fn registrar(&self) -> Option<&dyn DynRegistrar> {
444 self.authenticator.as_ref().and(self.registrar.as_deref())
445 }
446
447 /// The sign-up throttle, counted per client address.
448 pub(crate) fn throttle_sign_ups(&self) -> &LoginThrottle {
449 &self.sign_up_throttle
450 }
451
452 /// The profile editor, or `None` without a profile page.
453 pub(crate) fn profile_editor(&self) -> Option<&dyn DynProfileEditor> {
454 self.authenticator
455 .as_ref()
456 .and(self.profile_editor.as_deref())
457 }
458
459 /// The profile throttle, counted per user.
460 pub(crate) fn throttle_profile(&self) -> &LoginThrottle {
461 &self.profile_throttle
462 }
463
464 /// The password reset, or `None` without a forgot-password page.
465 pub(crate) fn reset(&self) -> Option<&PasswordReset<()>> {
466 self.authenticator.as_ref().and(self.reset.as_ref())
467 }
468
469 /// The email verification, or `None` when the panel asks for none.
470 pub(crate) fn verification(&self) -> Option<&EmailVerification<()>> {
471 self.authenticator.as_ref().and(self.verification.as_ref())
472 }
473
474 /// The tenant registration, or `None` without a tenant registration page.
475 pub(crate) fn tenant_registration_page(&self) -> Option<&TenantRegistration<()>> {
476 self.authenticator
477 .as_ref()
478 .and(self.tenant_registration.as_ref())
479 }
480
481 /// The tenant editor, or `None` without a tenant settings page.
482 pub(crate) fn tenant_editor(&self) -> Option<&dyn DynTenantEditor> {
483 self.authenticator
484 .as_ref()
485 .and(self.tenant_editor.as_deref())
486 }
487
488 /// The two-factor sign-in, or `None` when the panel asks for one factor.
489 pub(crate) fn two_factor_config(&self) -> Option<&TwoFactor> {
490 self.authenticator.as_ref().and(self.two_factor.as_ref())
491 }
492
493 /// The auth mail, or `None` when the panel mails nothing.
494 pub(crate) fn auth_mail(&self) -> Option<&AuthMail> {
495 self.authenticator.as_ref().and(self.mail.as_ref())
496 }
497
498 /// The features that send mail, by name, for the mount's checks.
499 pub(super) fn mailing(&self) -> Vec<&'static str> {
500 [
501 self.reset.is_some().then_some("password_reset"),
502 self.verification.is_some().then_some("email_verification"),
503 self.two_factor
504 .as_ref()
505 .is_some_and(|two_factor| two_factor.mails())
506 .then_some("two_factor"),
507 ]
508 .into_iter()
509 .flatten()
510 .collect()
511 }
512
513 /// Whether the panel issues [`AuthToken`](super::AuthToken)s, so the model must be registered:
514 /// it mails links, or challenges a second factor.
515 pub(crate) fn issues_tokens(&self) -> bool {
516 self.authenticator.is_some() && (!self.mailing().is_empty() || self.two_factor.is_some())
517 }
518}
519
520impl std::fmt::Debug for AuthConfig {
521 fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
522 if self.is_disabled() {
523 f.write_str("Auth::disabled")
524 } else {
525 f.debug_struct("Auth")
526 .field("throttle", &self.throttle)
527 .field("account_throttle", &self.account_throttle)
528 .field("registration", &self.registrar.is_some())
529 .field("profile", &self.profile_editor.is_some())
530 .field("password_reset", &self.reset)
531 .field("email_verification", &self.verification)
532 .field("tenant_registration", &self.tenant_registration)
533 .field("tenant_profile", &self.tenant_editor.is_some())
534 .field("two_factor", &self.two_factor)
535 .field("mail", &self.mail)
536 .finish_non_exhaustive()
537 }
538 }
539}