Module auth 

Authentication primitives: password hashing, random tokens, cookies and the request extractors that resolve the current user.

• Browser users authenticate with a session cookie (tc_session).
• API clients authenticate with a personal access token sent as Authorization: Bearer tc_pat_…. The API never accepts cookies, which keeps it immune to CSRF.

Re-exports

pub use services::membership_conditions::Origin;

Structs

Actor

The authenticated user on whose behalf a request is executed.

ApiCaller

The user of an API request and the scope of its token. Refuses (403) a request outside the scope: a read_only token may only send GET/HEAD requests and post to the MCP endpoint (whose dispatcher allows it the read-only tools only), an mcp_only token may only post to the MCP endpoint (domain::TokenScope::allows_request).

ApiUser

Extracts the user of an API request from a bearer token.

SignInThrottle

Failed password sign-ins per username and per client address (TEAMCRAFT_SIGNIN_MAX_FAILURES within SIGN_IN_WINDOW); once a counter is full, sign-in for that name or address is refused with 429 until the window has passed – without checking the password. Counted in memory per server process; a successful sign-in clears the username’s counter, not the address’s (else an attacker with an account of their own could reset it between guesses).

WebUser

Extracts the user of a browser session. Rejects with 401, which the web UI turns into a redirect to the login page.

Constants

API_TOKEN_PREFIX

FLASH_COOKIE

SESSION_COOKIE

SESSION_TOKEN_PREFIX

SIGN_IN_ADDRESS_FACTOR

A client address may fail this many times the per-username limit: an office behind one NAT address shares it.

SIGN_IN_WINDOW

How long failed sign-ins are counted (from the first failure).

Functions

clear_flash_cookie

clear_session_cookie

client_address

The client address of a request: the peer, or – when the peer is a reverse proxy on an internal address – the last X-Forwarded-For entry, the one that proxy added (a client can only prepend to the header). In tests without a peer address, the header alone.

cookie_value

Returns the value of the cookie name from the request headers.

flash_cookie

generate_token

Generates a random token with 256 bits of entropy, e.g. tc_pat_3f9a….

hash_password

Hashes a password with Argon2id (OWASP recommended default parameters).

hash_password_async

Runs Argon2 on the blocking thread pool (it is deliberately CPU heavy).

hash_token

Tokens are high-entropy, so a fast hash is sufficient for storage.

session_cookie

verify_password

Verifies a password against a stored PHC hash string.

verify_password_async

Verifies on the blocking pool. hash = None performs a dummy verification.