iet-auth-profiles

Implements verified persona selection, independent of token and policy mechanisms.

How to use it

iet-auth-profiles performs verified persona selection: given an authenticated Principal and a profile name, it confirms the subject owns that persona and returns a new Principal with the profile set. It depends only on the ProfileStore port, so the store implementation (for example a Timescale-backed one) stays independently selectable from tokens and policies.

// crates/features/iet-auth-profiles/tests/profiles.rs
use iet_auth::ProfileStore;
use iet_auth_profiles::Profiles;
use iet_core::{AppResult, Principal};

struct Store;
impl ProfileStore for Store {
    async fn enabled(&self, subject: &str, profile: &str) -> AppResult<bool> {
        Ok(subject == "user" && profile == "buyer")
    }
}

let identity = Principal {
    subject: "user".into(),
    profile: Some("old".into()),
};
// Selection verifies ownership and replaces (never merges) the profile.
let selected = Profiles(Store).select(&identity, "buyer").await?;
assert_eq!(selected.profile.as_deref(), Some("buyer"));
assert!(Profiles(Store).select(&identity, "admin").await.is_err());

• An empty subject fails with auth.required; an unknown or disabled profile fails with profile.denied.
• Profile names are bounded to 1024 bytes and the subject is preserved unchanged.
• Profiles are identity-owned personas, not roles or tenants; iet-auth-rbac and iet-auth-acl decide access.

How it works

select rejects an empty subject, asks the ProfileStore whether the subject owns the requested profile, and returns a new Principal that replaces the old profile rather than merging it.

sequenceDiagram
  participant C as "Caller"
  participant P as "Profiles"
  participant S as "ProfileStore"
  C->>P: "select identity profile"
  alt "subject empty"
    P-->>C: "auth.required"
  else "subject present"
    P->>S: "enabled subject profile"
    S-->>P: "bool"
    alt "enabled"
      P-->>C: "Principal with profile"
    else "disabled or invalid"
      P-->>C: "profile.denied"
    end
  end

What it implements

• Implements iet_auth::ProfileStore-related selection from iet-auth.

What's inside

Modules

• src/lib.rs

Public API

(root)

• struct Profiles

Impl map

• ProfileStore for Store

Depends on

• iet-core
• iet-auth

Used by

• No other framework crate depends on it directly.

In this repository

• Not used by a checked-in example yet.

Source: crates/features/iet-auth-profiles