mars-server · auth · MARS Docs

Package: mars-server · Workspace version: 0.1.0 · Module: auth

This reference follows declared modules and public syntax, including public implementation methods. Function bodies and constant values are omitted. Feature conditions are retained. Private-module re-exports and trait resolution require the compiler; not every declaration is a root import.

auth::adapters

Provider-neutral authentication and capability authorization for MARS.

The always-on domain consists of [Principal], [Capability], durable session/challenge ports, and [AuthProfileRegistry]. Provider integrations are adapters; the only concrete adapter in this release is SIWS and it is compiled behind the optional sigil feature.

pub mod adapters;

Source line: 8.

auth::challenge_store

pub mod challenge_store;

Source line: 9.

auth::handlers

pub mod handlers;

Source line: 10.

auth::principal

pub mod principal;

Source line: 11.

auth::registry

pub mod registry;

Source line: 12.

auth::session_store

pub mod session_store;

Source line: 13.

pub use challenge_store::PostgresChallengeStore;

#[cfg(feature = "postgres")]
pub use challenge_store::PostgresChallengeStore;

Source line: 19.

pub use challenge_store::{AuthChallengeStore, ChallengeRecord, InMemoryChallengeStore};

pub use challenge_store::{AuthChallengeStore, ChallengeRecord, InMemoryChallengeStore};

Source line: 20.

pub use principal::{AuthError, AuthProfile, Capability, CapabilitySet, Credential, Principal};

pub use principal::{AuthError, AuthProfile, Capability, CapabilitySet, Credential, Principal};

Source line: 21.

pub use registry::{AuthProfileAdapter, AuthProfileRegistry};

pub use registry::{AuthProfileAdapter, AuthProfileRegistry};

Source line: 22.

pub use session_store::PostgresSessionStore;

#[cfg(feature = "postgres")]
pub use session_store::PostgresSessionStore;

Source line: 24.

pub use session_store::{InMemorySessionStore, IssuedSession, SessionStore};

pub use session_store::{InMemorySessionStore, IssuedSession, SessionStore};

Source line: 25.

auth::DEFAULT_SESSION_TTL_MS

Default session TTL (7 days, expressed in milliseconds).

pub const DEFAULT_SESSION_TTL_MS: i64;

Source line: 28.

auth::MAX_SESSION_TTL_MS

Maximum session TTL (90 days, expressed in milliseconds).

Every authentication profile must enforce this server-owned ceiling so an operator unit error cannot silently create effectively permanent sessions.

pub const MAX_SESSION_TTL_MS: i64;

Source line: 34.

auth::DEFAULT_CHALLENGE_TTL_MS

Default challenge TTL (5 minutes, expressed in milliseconds).

Matches sigil_sdk::DEFAULT_MAX_SIGN_IN_CHALLENGE_TTL_MS so the verifier does not reject our challenges as too long-lived.

pub const DEFAULT_CHALLENGE_TTL_MS: i64;

Source line: 40.

auth::DEFAULT_MAX_CLOCK_SKEW_MS

Maximum clock skew the verifier tolerates (5 minutes).

pub const DEFAULT_MAX_CLOCK_SKEW_MS: i64;

Source line: 43.

auth::ServerClock

Server-controlled time source used by issuance, lookup, and verification.

pub trait ServerClock: Send + Sync {
    /// Current Unix timestamp in milliseconds.
    fn now_ms(&self) -> i64;
}

Source line: 46.

auth::SystemClock

Production wall-clock implementation.

#[derive(Debug, Default)]
pub struct SystemClock;

Source line: 53.

auth::AuthState

Authentication state plumbed into [crate::api::AppState].

pub struct AuthState {
/// Provider-neutral pending challenge persistence.

pub challenges: Arc<dyn AuthChallengeStore>,
/// Provider-neutral active session persistence.

pub sessions: Arc<dyn SessionStore>,
/// Default session TTL in milliseconds.

pub session_ttl_ms: i64,
/// Default challenge TTL in milliseconds.

pub challenge_ttl_ms: i64
}

Source line: 62.

auth::AuthState::from_parts

Build auth state from explicit provider-neutral stores and adapters.

pub fn from_parts(
        sessions: Arc<dyn SessionStore>,
        challenges: Arc<dyn AuthChallengeStore>,
        registry: AuthProfileRegistry,
        enabled_profiles: BTreeSet<AuthProfile>,
        clock: Arc<dyn ServerClock>,
        session_ttl_ms: i64,
        challenge_ttl_ms: i64,
    ) -> Result<Self, AuthError>;

Source line: 80.

auth::AuthState::in_memory

Process-local auth state with no credential adapters.

Intended for tests and explicit development mode where sessions are seeded directly.

pub fn in_memory() -> Self;

Source line: 122.

auth::AuthState::authenticate

Authenticate through a configured concrete adapter.

pub async fn authenticate(&self, credential: &Credential) -> Result<Principal, AuthError>;

Source line: 135.

auth::AuthState::registered_profiles

Profiles backed by concrete adapters in this process.

pub fn registered_profiles(&self) -> BTreeSet<AuthProfile>;

Source line: 149.

auth::AuthState::registry

Borrow the concrete adapter registry for startup validation.

pub fn registry(&self) -> &AuthProfileRegistry;

Source line: 154.

auth::AuthState::enabled_profiles

Profiles enabled by operator configuration.

pub fn enabled_profiles(&self) -> &BTreeSet<AuthProfile>;

Source line: 159.

auth::AuthState::has_durable_storage

Whether both authentication stores survive process restart.

pub fn has_durable_storage(&self) -> bool;

Source line: 164.

auth::AuthState::now_ms

Trusted current time for middleware and handlers.

pub fn now_ms(&self) -> i64;

Source line: 169.

auth::AuthState::new

Build process-local SIWS auth for tests and development.

#[cfg(feature = "sigil")]
pub fn new(
        anchor_client: Arc<dyn mars_protocol::SigilAnchorClient>,
    ) -> Result<Self, AuthError>;

Source line: 175.

auth::AuthState::with_clock

Build process-local SIWS auth with a deterministic server clock.

#[cfg(feature = "sigil")]
pub fn with_clock(
        anchor_client: Arc<dyn mars_protocol::SigilAnchorClient>,
        clock: Arc<dyn ServerClock>,
    ) -> Result<Self, AuthError>;

Source line: 183.

auth::AuthState::with_siws_stores

Build SIWS auth with explicit durable or process-local stores.

#[cfg(feature = "sigil")]
pub fn with_siws_stores(
        anchor_client: Arc<dyn mars_protocol::SigilAnchorClient>,
        sessions: Arc<dyn SessionStore>,
        challenges: Arc<dyn AuthChallengeStore>,
        clock: Arc<dyn ServerClock>,
        session_ttl_ms: i64,
        challenge_ttl_ms: i64,
        enabled_profiles: BTreeSet<AuthProfile>,
    ) -> Result<Self, AuthError>;

Source line: 200.

Source provenance

Source: mars-server/src/auth/mod.rs · SHA-256 43b2f659f5dbebdeb628cf7a2029788b2422f4bff73ee022c24938d8d84284a4. Package overview.

mars-server · auth

On this page