Struct websession::Authenticator

pub struct Authenticator { /* fields omitted */ }

The Authenticator is the main interface to Websession. It is responsible for tracking session IDs, and the users associated with the ID, if any. It also provides pass through support to the BackingStore for user management.

Implementations

impl Authenticator

pub fn new(
    backing_store: Box<dyn BackingStore + Send + Sync>,
    expiration: Duration,
    policy: SessionPolicy
) -> Authenticator

Create a new Authenticator. expiration is how long a session should live w/o activity. Activity resets the clock on a session.

pub fn verify(&self, user: &str, credentials: &str) -> Result<bool, AuthError>

Verify that the provided credentials apply to the given user. Doesn't change any signatures associated with the user.

pub fn login(
    &self,
    user: &str,
    credentials: &str,
    signature: &ConnectionSignature
) -> Result<(), AuthError>

Verify that the provided credentials apply to the given user. If they do, associate the user with the given signature. Credentials are as provided by the user; plain text in the case of passwords.

pub fn logout(&self, signature: &ConnectionSignature)

Remove any association of a user to the given signature, and remove the session.

pub fn get_user(
    &self,
    signature: &ConnectionSignature
) -> Result<Option<String>, AuthError>

Get the user associated with the session, if any.

pub fn encrypt_credentials(&self, plain_cred: &str) -> Result<String, AuthError>

Encrypt the credentials as expected by the backing store.

pub fn update_credentials(
    &self,
    user: &str,
    enc_creds: &str
) -> Result<(), AuthError>

Update the user's credentials, e.g. password. Credentials should already be encrypted/hashed, or the user will not be able to log in (and plain text will be stored in the backing store).

pub fn update_credentials_plain(
    &self,
    user: &str,
    plain_creds: &str
) -> Result<(), AuthError>

Update the user's credentials, e.g. password. Credentials should be in plain text, which will then be encrypted according to the BackingStore's implementation.

pub fn lock_user(&self, user: &str) -> Result<(), AuthError>

Disable a user's ability to login. The password will not be changed, but all login attempts will fail.

pub fn is_locked(&self, user: &str) -> Result<bool, AuthError>

Check if the user's account is locked.

pub fn unlock(&self, user: &str) -> Result<(), AuthError>

Re-enable the user's account. The old password will remain valid.

pub fn create_preencrypted(
    &self,
    user: &str,
    enc_creds: &str
) -> Result<(), AuthError>

Create a new user with the given credentials. Credentials should already be encrypted/hashed, or the user will not be able to log in (and plain text will end up stored in the backing store).

pub fn create_plain(
    &self,
    user: &str,
    plain_creds: &str
) -> Result<(), AuthError>

Create a new user with the given credentials. Credentials should be in plain text, which will then be encrypted according to the BackingStore's implementation.

pub fn delete(&self, user: &str) -> Result<(), AuthError>

Delete the given user. Any stored credentials will be deleted too, and will need to be provided again if the user is later re-created.

pub fn run(
    &self,
    signature: ConnectionSignature
) -> Result<ConnectionSignature, AuthError>

This is the main driver. It returns a signature that contains the current value for the cookie, or an error if something went wrong. The returned signature may be different from the one provided.

pub fn users(&self) -> Result<Vec<String>, AuthError>

Return a Vec of usernames.

pub fn users_iter(&self) -> Result<IntoIter<String>, AuthError>

Return an iterator over users.

pub fn check_user(&self, user: &str) -> Result<bool, AuthError>

Identify whether or not the user already exists in the backing store. May return an AuthError; in particular, AuthError::Locked, which means that the user exists but the account is locked. Applications shouldn't expose the specific error without a good readon, as this could allow enumerating accounts.

Trait Implementations

impl Debug for Authenticator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.