Brummel
76e8ee18e9
This commit introduces a new magic link authentication flow. The desktop client can now request a temporary, one-time-use token from the server. This token is then used to open a URL in the system browser, which redirects to the server. The server consumes the token, installs a regular web session, and redirects the user
28 lines
906 B
Rust
28 lines
906 B
Rust
//! Short-lived, one-time tokens that turn a desktop API-key auth into a
|
|
//! browser session without an interactive password login.
|
|
//!
|
|
//! Lifecycle: the desktop client calls `POST /api/auth/magic-link` (API-key
|
|
//! authenticated), gets a token, opens the browser at `/web/magic?token=…`.
|
|
//! The web handler removes the token (one-time-use) and installs a regular
|
|
//! `WebSession`. TTL is intentionally short — the token only needs to
|
|
//! survive the click → browser-launch → first-request round trip.
|
|
|
|
use std::collections::HashMap;
|
|
use std::sync::Arc;
|
|
use std::time::Instant;
|
|
|
|
use tokio::sync::RwLock;
|
|
|
|
pub struct PendingMagicLink {
|
|
pub slug: String,
|
|
pub role: String,
|
|
pub return_to: String,
|
|
pub expires_at: Instant,
|
|
}
|
|
|
|
pub type MagicLinkStore = Arc<RwLock<HashMap<String, PendingMagicLink>>>;
|
|
|
|
pub fn new_store() -> MagicLinkStore {
|
|
Arc::new(RwLock::new(HashMap::new()))
|
|
}
|