Umbral Auth

Every app hits the same wall on day two: who is this request, and are they allowed? Umbral Auth answers it out of the box — a battle-tested AuthUser model, groups, argon2 password hashing with sane defaults, opaque DB-backed API tokens, and password-reset flows. Its LoggedIn<T> extractor turns "is the caller authenticated?" into a function argument the compiler enforces: a handler that takes LoggedIn<AuthUser> simply cannot run for an anonymous request.

Install

cargo add umbral-auth
cargo add umbral-sessions   # auth needs a place to keep the session

Wire it up

use umbral::prelude::*;
use umbral_auth::{AuthPlugin, AuthUser};
use umbral_sessions::SessionsPlugin;

let app = App::builder()
    .database("default", pool)
    .plugin(SessionsPlugin::default())
    .plugin(
        AuthPlugin::<AuthUser>::default()
            .with_default_routes()        // /login, /logout, /signup
            .with_user_in_templates(),    // `user` available in every template
    )
    .build()?;

Target: lock a route to signed-in users

The extractor is the gate. If it can't build an authenticated user, the handler never runs.

use umbral_auth::{LoggedIn, AuthUser};

async fn dashboard(user: LoggedIn<AuthUser>) -> Html<String> {
    Html(format!("Welcome back, {}", user.username))
}

What you get

• AuthUser + groups/roles, ready to migrate
• Argon2 password hashing (drop-in from bcrypt without surprises)
• Opaque, hashed-at-rest bearer tokens for API clients
• LoggedIn<T> / login_required_html("/login") guards
• Token-based password reset (email delivery via umbral-email)
• Pairs with umbral-oauth for Google / GitHub social login