auth-core
Users, identities, credentials, sessions and single-use tokens. Authorization code with PKCE, ES256 JWTs with JWKS, account linking on verified email only.
As a git dependency
cargo add cratefield-auth-core --git https://github.com/Cratefield/harnessIn the repository, not on crates.io yet.
What it is
auth-core.
Users, identities, credentials, sessions, single-use tokens, clients and their redirect URIs, plus the flows every login method shares: authorization code with PKCE, ES256 access tokens published through JWKS, and account linking that only ever joins two identities on an email both providers say they verified.
Anything single-use lives in the database, never in KV. KV is eventually consistent, and magic links, WebAuthn challenges, authorization codes and refresh tokens are all things that must be spendable exactly once. They go in single_use_tokens with a kind, consumed by a guarded update whose affected-row count is checked, so two concurrent consumes cannot both win. Nothing that can log somebody in — session cookie values, magic-link tokens, client secrets — is stored in the clear.
Ports
Database · Clock · IdGen
Tables it owns
users, identities, credentials, sessions, single_use_tokens, clients, client_redirect_uris
History
Changelog.
Not released on its own: it is taken from the repository as a git dependency, and has no CHANGELOG.md yet.
Every other login method is a crate that sits on this one.