iet-auth-profiles-timescale

Persists persona enablement without owning identity or credential tables.

How to use it

Owns fw_auth_profiles and implements iet_auth::ProfileStore; list_enabled returns the personas an authenticated identity may pick. Register it after the identity table, then attach it to session/RBAC/ACL stores with with_profiles(...) so profile changes gate them.

// examples/htmx-starter/servers/web/src/providers.rs
let profiles = iet_auth_profiles_timescale::ProfileStore::new(database.clone());

// Persona choices for the login/profile UI.
let choices = profiles.list_enabled(&identity.subject).await?;

// Authorize a specific selection.
if !profiles.enabled(&identity.subject, &profile).await? {
    return Err(invalid());
}

// Registration: examples/skills-only-app-task-tracker/servers/web/src/database.rs
let mut registry = EntityRegistry::default();
iet_auth_identity_timescale::register(&mut registry)?;
iet_auth_profiles_timescale::register(&mut registry)?;

• with_profiles is how other stores consume this crate; each store re-checks the policy after reading.

How it works

ProfileStore::enabled validates the profile then runs repository::profile, while list_enabled runs repository::list; both queries join fw_auth_profiles with fw_auth_identities and require both rows to be enabled.

flowchart LR
  Enabled["ProfileStore enabled"] --> Valid["valid profile"]
  Valid --> Repo["repository profile"]
  List["list_enabled"] --> Repo2["repository list"]
  Repo --> Prof["fw_auth_profiles"]
  Repo --> Id["fw_auth_identities"]
  Repo2 --> Prof
  Repo2 --> Id

What it implements

• Implements iet_auth::ProfileStore from iet-auth.

Database schema

The details below come from #[derive(Persistent)] entity metadata:

fw_auth_profiles

Entity Profile (hard delete).

Foreign key auth_profile_subject: (subject) → fw_auth_identities (id)

Entities register into an EntityRegistry; EntityRegistry::initial emits a reviewed migration pair, and Migrations applies reviewed files. See iet-db-timescale and iet-db.

What's inside

Modules

• src/entity.rs
• src/lib.rs
• src/repository.rs
• src/stores.rs

Public API

(root)

• pub fn register(registry: &mut EntityRegistry) -> AppResult<()> — Register the owned table; register identity tables separately before generating SQL.

entity

• struct Profile

stores

• struct ProfileStore
• pub fn new(database: TimescaleDatabase) -> Self

Impl map

• iet_auth::ProfileStore for ProfileStore

Depends on

• iet-telemetry
• iet-core
• iet-auth
• iet-db-timescale
• iet-db-macros

External crates: sqlx, uuid

Used by

• No other framework crate depends on it directly.

In this repository

• examples/htmx-starter
• examples/skills-only-app
• examples/skills-only-app-task-tracker

Source: crates/integrations/iet-auth-profiles-timescale