Echo
6811f84a7c
- pm-auth::password: Argon2id (m=65536,t=3,p=1) hashing + verification - pm-auth::jwt: EdDSA/Ed25519 JWT issuance + validation (15-min TTL) - pm-auth::refresh: Opaque 256-bit refresh tokens, SHA-256 hashed, 1-hour sliding inactivity timeout, rotation on use, revocable - pm-auth::mfa_totp: TOTP setup/verify (HMAC-SHA1, 6-digit, 30s) with otpauth:// URI generation (Google Authenticator compatible) - pm-auth::mfa_webauthn: Stub (full implementation deferred) - pm-auth::rbac: Axum middleware for JWT auth + IP whitelist + admin/operator role enforcement + FromRequestParts extractor - pm-auth::session: Full login flow (password → MFA → tokens), token refresh, logout, force-logout - pm-web auth routes: POST /api/v1/auth/login|refresh|logout, GET /api/v1/auth/mfa/setup, POST /api/v1/auth/mfa/verify - IP whitelist middleware on all protected connection points - migrations/002_seed_admin.sql: Default admin account seed - Frontend: Auth store (Zustand with persistence), login page with MFA prompt, MFA setup page (stepper), JWT auto-refresh interceptor, route guards (RequireAuth), updated App.tsx routing - cargo check --workspace: zero errors, 1 minor warning Closes M2.
25 lines
963 B
Rust
25 lines
963 B
Rust
//! pm-auth — Authentication and authorization.
|
|
//!
|
|
//! Modules:
|
|
//! - `password` — Argon2id password hashing (m=65536, t=3, p=1)
|
|
//! - `jwt` — EdDSA/Ed25519 JWT issuance and validation (15-min TTL)
|
|
//! - `refresh` — Opaque 256-bit refresh tokens (1-hour sliding window)
|
|
//! - `mfa_totp` — TOTP setup and verification (Google Authenticator compatible)
|
|
//! - `mfa_webauthn` — WebAuthn stub (full implementation pending)
|
|
//! - `rbac` — Axum middleware for JWT authentication and role enforcement
|
|
//! - `session` — Login flow orchestration (password → MFA → tokens)
|
|
|
|
pub mod jwt;
|
|
pub mod mfa_totp;
|
|
pub mod mfa_webauthn;
|
|
pub mod password;
|
|
pub mod rbac;
|
|
pub mod refresh;
|
|
pub mod session;
|
|
|
|
// Commonly re-exported types
|
|
pub use jwt::{AccessClaims, JwtError};
|
|
pub use password::{hash_password, verify_password, PasswordError};
|
|
pub use rbac::{AuthConfig, AuthUser, UserRole};
|
|
pub use session::{LoginRequest, LoginResponse, SessionError, SessionUser};
|