micromegas_auth/
lib.rs

1//! Authentication providers for Micromegas
2//!
3//! This crate provides authentication and authorization for Micromegas services.
4//! It supports multiple authentication methods:
5//!
6//! - **API Keys**: Simple bearer token authentication
7//! - **OIDC**: OpenID Connect authentication with automatic JWKS caching
8//!
9//! # Example: API Key Authentication
10//!
11//! ```rust
12//! use micromegas_auth::api_key::{ApiKeyAuthProvider, parse_key_ring};
13//! use micromegas_auth::types::{AuthProvider, HttpRequestParts, RequestParts};
14//!
15//! # async fn example() -> anyhow::Result<()> {
16//! let json = r#"[{"name": "user1", "key": "secret-key-123"}]"#;
17//! let keyring = parse_key_ring(json)?;
18//! let provider = ApiKeyAuthProvider::new(keyring);
19//!
20//! // Create request parts with Bearer token
21//! let mut headers = http::HeaderMap::new();
22//! headers.insert(
23//!     http::header::AUTHORIZATION,
24//!     "Bearer secret-key-123".parse().unwrap(),
25//! );
26//! let parts = HttpRequestParts {
27//!     headers,
28//!     method: http::Method::GET,
29//!     uri: "/api/endpoint".parse().unwrap(),
30//!     client_ip: None,
31//! };
32//!
33//! let auth_ctx = provider.validate_request(&parts as &dyn RequestParts).await?;
34//! println!("Authenticated: {}", auth_ctx.subject);
35//! # Ok(())
36//! # }
37//! ```
38//!
39//! # Example: OIDC Authentication
40//!
41//! ```rust,no_run
42//! use micromegas_auth::oidc::{OidcAuthProvider, OidcConfig, OidcIssuer};
43//! use micromegas_auth::types::{AuthProvider, HttpRequestParts, RequestParts};
44//!
45//! # async fn example() -> anyhow::Result<()> {
46//! let config = OidcConfig {
47//!     issuers: vec![OidcIssuer {
48//!         issuer: "https://accounts.google.com".to_string(),
49//!         audience: "your-client-id.apps.googleusercontent.com".to_string(),
50//!     }],
51//!     jwks_refresh_interval_secs: 3600,
52//!     token_cache_size: 1000,
53//!     token_cache_ttl_secs: 300,
54//! };
55//!
56//! let provider = OidcAuthProvider::new(config).await?;
57//!
58//! // Create request parts with ID token
59//! let mut headers = http::HeaderMap::new();
60//! headers.insert(
61//!     http::header::AUTHORIZATION,
62//!     "Bearer id_token_here".parse().unwrap(),
63//! );
64//! let parts = HttpRequestParts {
65//!     headers,
66//!     method: http::Method::GET,
67//!     uri: "/api/endpoint".parse().unwrap(),
68//!     client_ip: None,
69//! };
70//!
71//! let auth_ctx = provider.validate_request(&parts as &dyn RequestParts).await?;
72//! println!("Authenticated: {}", auth_ctx.subject);
73//! # Ok(())
74//! # }
75//! ```
76
77/// Core authentication types and traits
78pub mod types;
79
80/// Client IP resolution (X-Forwarded-For / X-Real-IP / socket address), shared by every
81/// `RequestParts` construction site and by [`ip_allowlist`]'s allowlist check.
82pub mod client_ip;
83
84/// A typed, CIDR-based IP allowlist -- the decision point `ApiKeyAuthProvider` and
85/// `DbApiKeyAuthProvider` both call to enforce a per-key source-IP restriction.
86pub mod ip_allowlist;
87
88/// Shared prefixed-env-var resolution (`{prefix}_{suffix}` with `MICROMEGAS_{suffix}` fallback)
89pub mod env;
90
91/// API key authentication
92pub mod api_key;
93
94/// DB-backed API key authentication
95pub mod db_api_key;
96
97/// OIDC authentication with JWKS caching
98pub mod oidc;
99
100/// Canonical login-flow OIDC client construction (discovery + client building)
101pub mod oidc_client;
102
103/// Multi-provider authentication (API key + OIDC)
104pub mod multi;
105
106/// Default authentication provider initialization
107pub mod default_provider;
108
109/// Tower service layer for tonic/gRPC authentication
110pub mod tower;
111
112/// Axum middleware for HTTP authentication
113pub mod axum;
114
115/// URL validation utilities for authentication flows
116pub mod url_validation;
117
118/// OAuth state parameter signing and verification
119pub mod oauth_state;
120
121/// User attribution validation (prevents impersonation attacks)
122pub mod user_attribution;
123
124/// Authorization seam: `MintPolicy`, `ReadPolicy`, and their audience-based implementations
125pub mod policy;
126
127/// Generic whole-table snapshot cache shared by the audience-grant and group stores
128pub mod db_snapshot;
129
130/// DB-backed audience grant store
131pub mod db_audience_grants;
132
133/// Local group membership: `GroupGraph`, the DB-backed store, and closure resolution
134pub mod groups;
135
136/// Wraps an `AuthProvider` to resolve transitive local-group membership per request
137pub mod membership;
micromegas_auth/lib.rs

micromegas_auth/
lib.rs
