iet-auth-identity-timescale

Owns the neutral identity table and shared fail-closed profile policy helpers.

How to use it

Provides the neutral fw_auth_identities table and the default fail-closed profile policy (NoProfiles / profile_enabled). Every identity-owned capability — credentials, profiles, sessions, RBAC, ACL — requires it to be registered first; revocations is the only capability that may be registered without it.

// examples/htmx-starter/servers/web/tests/framework_auth_common/mod.rs
let mut registry = EntityRegistry::default();
if identity {
    iet_auth_identity_timescale::register(&mut registry).unwrap();
}
for (bit, register) in CAPABILITIES {
    if mask & bit != 0 {
        register(&mut registry).unwrap();
    }
}

// Default policy for stores that do not attach a profiles backend:
use iet_auth_identity_timescale::{NoProfiles, profile_enabled};

let policy = NoProfiles; // denies every non-empty profile
let allowed = profile_enabled(&policy, &identity).await?;

• Identity exposes only id and enabled, with no credential or profile columns.
• Stores accept a policy through with_profiles(...); identity-only principals (profile == None) are always allowed.

How it works

register adds the Identity entity, so EntityRegistry emits fw_auth_identities and every dependent capability can reference it; the crate also re-exports NoProfiles and profile_enabled as the shared default policy.

flowchart LR
  Reg["register"] --> Entity["Identity"]
  Entity --> Table["fw_auth_identities"]
  Basic["iet_auth_basic_timescale"] --> Table
  Profiles["iet_auth_profiles_timescale"] --> Table
  Sessions["iet_auth_session_timescale"] --> Table
  Rbac["iet_auth_rbac_timescale"] --> Table
  Acl["iet_auth_acl_timescale"] --> Table

What it implements

• Concrete mechanism; see the public API below.

Database schema

The details below come from #[derive(Persistent)] entity metadata:

fw_auth_identities

Entity Identity (hard delete).

Entities register into an EntityRegistry; EntityRegistry::initial emits a reviewed migration pair, and Migrations applies reviewed files. See iet-db-timescale and iet-db.

What's inside

Modules

• src/lib.rs

Public API

(root)

• struct Identity
• pub fn register(registry: &mut EntityRegistry) -> AppResult<()> — Register once before registering any identity-owned capabilities.

Depends on

• iet-core
• iet-auth
• iet-db-timescale
• iet-db-macros

External crates: sqlx, uuid

Used by

• No other framework crate depends on it directly.

In this repository

• examples/htmx-starter
• examples/skills-only-app-task-tracker

Source: crates/integrations/iet-auth-identity-timescale