# rok-auth

JWT authentication, RBAC, email verification, password reset, TOTP, magic links,
passkeys, and device trust for Axum applications.

## Installation

```toml
[dependencies]
rok-auth = { version = "0.1", features = ["axum"] }
```

## Quick Start

```rust
use rok_auth::{Auth, AuthConfig, AuthUser};

// Configure
let auth = Auth::new(AuthConfig {
    secret: std::env::var("JWT_SECRET").unwrap(),
    access_ttl_secs: 900,
    refresh_ttl_secs: 604800,
});

// Issue tokens
let pair = auth.issue(user_id, claims_extras).await?;

// Protect a route
async fn me(auth: AuthUser) -> impl IntoResponse {
    Json(json!({ "id": auth.sub }))
}
```

## Features

| Feature | Description |
|---|---|
| `axum` | Axum extractors: `AuthUser`, `OptionalAuthUser`, middleware |
| `macros` | `#[require_auth]`, `#[require_role("admin")]` proc-macros |
| `magic-link` | Passwordless magic link authentication |
| `passkeys` | WebAuthn credential storage layer |
| `device-trust` | Remember-this-device tokens |

## Token Pair

```rust
let pair: TokenPair = auth.issue(user_id, json!({"role": "admin"})).await?;
// pair.access_token  — short-lived JWT (15 min default)
// pair.refresh_token — long-lived opaque token (7 days default)

let new_pair = auth.refresh(&pair.refresh_token).await?;
auth.revoke(&pair.refresh_token).await?;
```

## Email Verification

```rust
let token = EmailVerification::issue(&pool, user_id).await?;
// send token in email link
EmailVerification::verify(&pool, &token).await?; // marks user as verified
```

## Password Reset

```rust
let token = PasswordReset::issue(&pool, &email).await?;
PasswordReset::reset(&pool, &token, &new_password_hash).await?;
```

## Magic Link (feature: `magic-link`)

```rust
let link = MagicLink::issue(&pool, &email, ttl_secs).await?;
let user_id = MagicLink::verify(&pool, &token).await?;
```
