diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bc3c457..c9183ef 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -60,7 +60,7 @@ These crates are libraries two services build on; three rules keep them that way unified-api and unified-gitops against your branch (see [docs/development.md](docs/development.md#working-on-a-service-against-a-local-copy)). -`unified-auth` depends on `unified-secrets`, never the reverse. +`auth-rs` depends on `secrets-rs`, never the reverse. ## Code comments diff --git a/Cargo.lock b/Cargo.lock index 8975855..bd1fbee 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -81,6 +81,27 @@ version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0" +[[package]] +name = "auth-rs" +version = "0.2.0" +dependencies = [ + "axum", + "dashmap", + "getrandom 0.4.3", + "ldap3", + "rustls", + "rustls-pki-types", + "secrets-rs", + "serde", + "serde-saphyr", + "subtle", + "tempfile", + "tokio", + "tower", + "tracing", + "tracing-subscriber", +] + [[package]] name = "autocfg" version = "1.5.1" @@ -1228,6 +1249,20 @@ version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" +[[package]] +name = "secrets-rs" +version = "0.2.0" +dependencies = [ + "axum", + "reqwest", + "serde", + "serde-saphyr", + "serde_json", + "tempfile", + "tokio", + "tracing", +] + [[package]] name = "security-framework" version = "3.7.0" @@ -1725,41 +1760,6 @@ version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ca718471876992059f251e33aafc334346ada08042b7661dd1fe313a9bced557" -[[package]] -name = "unified-auth" -version = "0.2.0" -dependencies = [ - "axum", - "dashmap", - "getrandom 0.4.3", - "ldap3", - "rustls", - "rustls-pki-types", - "serde", - "serde-saphyr", - "subtle", - "tempfile", - "tokio", - "tower", - "tracing", - "tracing-subscriber", - "unified-secrets", -] - -[[package]] -name = "unified-secrets" -version = "0.2.0" -dependencies = [ - "axum", - "reqwest", - "serde", - "serde-saphyr", - "serde_json", - "tempfile", - "tokio", - "tracing", -] - [[package]] name = "untrusted" version = "0.9.0" diff --git a/Cargo.toml b/Cargo.toml index 567e905..4a87d22 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,7 +2,7 @@ # by tag, so both crates move together and a tag names one consistent pair. [workspace] resolver = "3" -members = ["crates/unified-secrets", "crates/unified-auth"] +members = ["crates/secrets-rs", "crates/auth-rs"] [workspace.package] version = "0.2.0" @@ -16,7 +16,7 @@ repository = "https://github.com/OpusProjects/auth" # Versions the crates share, declared once (crates name them with # `workspace = true`), so the two can never resolve different majors. [workspace.dependencies] -unified-secrets = { path = "crates/unified-secrets" } +secrets-rs = { path = "crates/secrets-rs" } # Vault's HTTP API. rustls instead of openssl to keep the build self-contained, # the same stack the services already use. reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] } diff --git a/README.md b/README.md index eb754a9..2248c7b 100644 --- a/README.md +++ b/README.md @@ -9,8 +9,8 @@ A secrets and sign-in library for web services, written in Rust. Auth holds what a service needs to read a credential and to sign a person in, in one place, so a fix lands in every service that uses it at once instead of being copied from one to the next. -Two crates in one workspace, released together under one tag: `unified-secrets` resolves credentials -from environment variables, JSON files or HashiCorp Vault, and `unified-auth` signs people in with +Two crates in one workspace, released together under one tag: `secrets-rs` resolves credentials +from environment variables, JSON files or HashiCorp Vault, and `auth-rs` signs people in with their directory account or an API key and keeps them signed in with a browser session. --- @@ -34,8 +34,8 @@ their directory account or an API key and keeps them signed in with a browser se | Document | What it covers | |---|---| -| [Secrets](docs/secrets.md) | The `unified-secrets` crate: credentials, the backends, `build_chain` and caching | -| [Sign-in](docs/sign-in.md) | The `unified-auth` crate: LDAP, access rules, the login, API keys, sessions | +| [Secrets](docs/secrets.md) | The `secrets-rs` crate: credentials, the backends, `build_chain` and caching | +| [Sign-in](docs/sign-in.md) | The `auth-rs` crate: LDAP, access rules, the login, API keys, sessions | | [Development](docs/development.md) | The workspace, the CI gates, and working on a service against a local copy | | [Releasing](docs/releasing.md) | How release-please cuts a version, and how a service moves to it | diff --git a/crates/unified-auth/Cargo.toml b/crates/auth-rs/Cargo.toml similarity index 83% rename from crates/unified-auth/Cargo.toml rename to crates/auth-rs/Cargo.toml index 2e65044..474e9e2 100644 --- a/crates/unified-auth/Cargo.toml +++ b/crates/auth-rs/Cargo.toml @@ -1,6 +1,6 @@ [package] -name = "unified-auth" -description = "Sign-in for the unified tools: LDAP accounts, access rules, a throttled login, API keys and browser sessions" +name = "auth-rs" +description = "Sign-in for web services: LDAP accounts, access rules, a throttled login, API keys and browser sessions" version.workspace = true edition.workspace = true rust-version.workspace = true @@ -12,7 +12,7 @@ readme = "../../README.md" publish = false [dependencies] -unified-secrets.workspace = true +secrets-rs.workspace = true ldap3.workspace = true rustls.workspace = true rustls-pki-types.workspace = true diff --git a/crates/unified-auth/src/directory.rs b/crates/auth-rs/src/directory.rs similarity index 100% rename from crates/unified-auth/src/directory.rs rename to crates/auth-rs/src/directory.rs diff --git a/crates/unified-auth/src/http/auth.rs b/crates/auth-rs/src/http/auth.rs similarity index 100% rename from crates/unified-auth/src/http/auth.rs rename to crates/auth-rs/src/http/auth.rs diff --git a/crates/unified-auth/src/http/mod.rs b/crates/auth-rs/src/http/mod.rs similarity index 100% rename from crates/unified-auth/src/http/mod.rs rename to crates/auth-rs/src/http/mod.rs diff --git a/crates/unified-auth/src/http/session.rs b/crates/auth-rs/src/http/session.rs similarity index 99% rename from crates/unified-auth/src/http/session.rs rename to crates/auth-rs/src/http/session.rs index ab7c542..1283405 100644 --- a/crates/unified-auth/src/http/session.rs +++ b/crates/auth-rs/src/http/session.rs @@ -214,7 +214,7 @@ pub fn cookie_value<'h>(header: &'h str, name: &str) -> Option<&'h str> { // The store, injected as a router Extension the way the key registry is. // `new` rather than the tuple constructor, so a service's type alias -// (`Sessions = unified_auth::http::Sessions`) can build one: Rust +// (`Sessions = auth_rs::http::Sessions`) can build one: Rust // lets an alias name a type, but not call a tuple struct's constructor. pub struct Sessions

(pub Arc>); diff --git a/crates/unified-auth/src/ldap.rs b/crates/auth-rs/src/ldap.rs similarity index 100% rename from crates/unified-auth/src/ldap.rs rename to crates/auth-rs/src/ldap.rs diff --git a/crates/unified-auth/src/ldap_directory.rs b/crates/auth-rs/src/ldap_directory.rs similarity index 100% rename from crates/unified-auth/src/ldap_directory.rs rename to crates/auth-rs/src/ldap_directory.rs diff --git a/crates/unified-auth/src/lib.rs b/crates/auth-rs/src/lib.rs similarity index 90% rename from crates/unified-auth/src/lib.rs rename to crates/auth-rs/src/lib.rs index 6369377..26f7807 100644 --- a/crates/unified-auth/src/lib.rs +++ b/crates/auth-rs/src/lib.rs @@ -1,4 +1,4 @@ -// unified-auth — signing people in to the unified tools. +// auth-rs — signing people in to a web service. // // A person logs in with their directory account (LDAP / Active Directory); // the directory says who they are and which groups they belong to, and the @@ -15,7 +15,7 @@ // that checks them, browser sessions, CSRF — generic over each service's // permissions type // -// The service account's password comes through unified-secrets, like any +// The service account's password comes through secrets-rs, like any // other credential. Shared by unified-api and unified-gitops: a fix here // lands in both. diff --git a/crates/unified-auth/src/login.rs b/crates/auth-rs/src/login.rs similarity index 99% rename from crates/unified-auth/src/login.rs rename to crates/auth-rs/src/login.rs index 53858b3..210ac88 100644 --- a/crates/unified-auth/src/login.rs +++ b/crates/auth-rs/src/login.rs @@ -2,7 +2,7 @@ use std::collections::HashMap; use std::sync::Mutex; use std::time::{Duration, Instant}; -use unified_secrets::SecretsPort; +use secrets_rs::SecretsPort; use crate::directory::{DirectoryError, DirectoryLogin, DirectoryPort}; use crate::ldap::{AccessRule, LdapConfig}; @@ -204,7 +204,7 @@ mod tests { use super::*; use crate::directory::{DirectoryFuture, DirectoryUser}; use crate::ldap::rule_names; - use unified_secrets::mock::MockSecrets; + use secrets_rs::mock::MockSecrets; // A service's rules, reduced to what the use case needs: who they name, // and whether they make that person an admin. diff --git a/crates/unified-auth/tests/fixtures/test-ca.pem b/crates/auth-rs/tests/fixtures/test-ca.pem similarity index 100% rename from crates/unified-auth/tests/fixtures/test-ca.pem rename to crates/auth-rs/tests/fixtures/test-ca.pem diff --git a/crates/unified-auth/tests/ldap_directory_test.rs b/crates/auth-rs/tests/ldap_directory_test.rs similarity index 98% rename from crates/unified-auth/tests/ldap_directory_test.rs rename to crates/auth-rs/tests/ldap_directory_test.rs index 0f65071..c5d6405 100644 --- a/crates/unified-auth/tests/ldap_directory_test.rs +++ b/crates/auth-rs/tests/ldap_directory_test.rs @@ -4,10 +4,10 @@ // directory, no network. use std::sync::Once; +use auth_rs::directory::{DirectoryError, DirectoryLogin, DirectoryPort, DirectoryUser}; +use auth_rs::ldap::LdapServer; +use auth_rs::ldap_directory::LdapDirectory; use tokio::io::{AsyncReadExt, AsyncWriteExt}; -use unified_auth::directory::{DirectoryError, DirectoryLogin, DirectoryPort, DirectoryUser}; -use unified_auth::ldap::LdapServer; -use unified_auth::ldap_directory::LdapDirectory; // One process-wide log subscriber, so every logged field is evaluated the // same way whichever test happens to reach a log line first. diff --git a/crates/unified-secrets/Cargo.toml b/crates/secrets-rs/Cargo.toml similarity index 85% rename from crates/unified-secrets/Cargo.toml rename to crates/secrets-rs/Cargo.toml index 05d2ff0..2ca7a4c 100644 --- a/crates/unified-secrets/Cargo.toml +++ b/crates/secrets-rs/Cargo.toml @@ -1,6 +1,6 @@ [package] -name = "unified-secrets" -description = "Credential resolution for the unified tools: environment variables, JSON files and HashiCorp Vault" +name = "secrets-rs" +description = "Credential resolution for services: environment variables, JSON files and HashiCorp Vault" version.workspace = true edition.workspace = true rust-version.workspace = true diff --git a/crates/unified-secrets/src/cache.rs b/crates/secrets-rs/src/cache.rs similarity index 100% rename from crates/unified-secrets/src/cache.rs rename to crates/secrets-rs/src/cache.rs diff --git a/crates/unified-secrets/src/chain.rs b/crates/secrets-rs/src/chain.rs similarity index 100% rename from crates/unified-secrets/src/chain.rs rename to crates/secrets-rs/src/chain.rs diff --git a/crates/unified-secrets/src/credential.rs b/crates/secrets-rs/src/credential.rs similarity index 100% rename from crates/unified-secrets/src/credential.rs rename to crates/secrets-rs/src/credential.rs diff --git a/crates/unified-secrets/src/env.rs b/crates/secrets-rs/src/env.rs similarity index 100% rename from crates/unified-secrets/src/env.rs rename to crates/secrets-rs/src/env.rs diff --git a/crates/unified-secrets/src/lib.rs b/crates/secrets-rs/src/lib.rs similarity index 93% rename from crates/unified-secrets/src/lib.rs rename to crates/secrets-rs/src/lib.rs index faae446..afc9f64 100644 --- a/crates/unified-secrets/src/lib.rs +++ b/crates/secrets-rs/src/lib.rs @@ -1,4 +1,4 @@ -// unified-secrets — resolving credentials for the unified tools. +// secrets-rs — resolving credentials for a service. // // A credential is a reference written in configuration: it says WHERE its // values live (environment variables, a JSON file, a HashiCorp Vault KV v2 diff --git a/crates/unified-secrets/src/mock.rs b/crates/secrets-rs/src/mock.rs similarity index 100% rename from crates/unified-secrets/src/mock.rs rename to crates/secrets-rs/src/mock.rs diff --git a/crates/unified-secrets/src/port.rs b/crates/secrets-rs/src/port.rs similarity index 100% rename from crates/unified-secrets/src/port.rs rename to crates/secrets-rs/src/port.rs diff --git a/crates/unified-secrets/src/reloadable.rs b/crates/secrets-rs/src/reloadable.rs similarity index 100% rename from crates/unified-secrets/src/reloadable.rs rename to crates/secrets-rs/src/reloadable.rs diff --git a/crates/unified-secrets/src/vault.rs b/crates/secrets-rs/src/vault.rs similarity index 100% rename from crates/unified-secrets/src/vault.rs rename to crates/secrets-rs/src/vault.rs diff --git a/crates/unified-secrets/tests/vault_test.rs b/crates/secrets-rs/tests/vault_test.rs similarity index 98% rename from crates/unified-secrets/tests/vault_test.rs rename to crates/secrets-rs/tests/vault_test.rs index ac3c4dc..e034638 100644 --- a/crates/unified-secrets/tests/vault_test.rs +++ b/crates/secrets-rs/tests/vault_test.rs @@ -8,10 +8,10 @@ use axum::http::{HeaderMap, StatusCode}; use axum::routing::{get, post}; use axum::{Json, Router}; -use unified_secrets::credential::Credential; -use unified_secrets::env::EnvSecrets; -use unified_secrets::port::SecretsPort; -use unified_secrets::vault::{VaultConfig, VaultSecrets}; +use secrets_rs::credential::Credential; +use secrets_rs::env::EnvSecrets; +use secrets_rs::port::SecretsPort; +use secrets_rs::vault::{VaultConfig, VaultSecrets}; async fn fake_vault() -> String { let app = Router::new() diff --git a/docs/development.md b/docs/development.md index 52056fe..68f022b 100644 --- a/docs/development.md +++ b/docs/development.md @@ -19,15 +19,15 @@ One Cargo workspace with two crates, sharing one version and one `Cargo.lock`. ``` Cargo.toml # the workspace: members, shared version, shared dependency versions crates/ -├── unified-secrets/src/ # credential, port, env, vault, cache, reloadable, chain, mock -└── unified-auth/src/ # directory, ldap_directory, ldap, login, http/ (auth, session) +├── secrets-rs/src/ # credential, port, env, vault, cache, reloadable, chain, mock +└── auth-rs/src/ # directory, ldap_directory, ldap, login, http/ (auth, session) docs/ # this documentation release-please-config.json # release-please: version files, changelog sections .release-please-manifest.json # the last released version ``` -`unified-auth` depends on `unified-secrets` (the LDAP bind credential is resolved through it), never -the reverse, so a tool that only needs secrets can depend on `unified-secrets` alone. +`auth-rs` depends on `secrets-rs` (the LDAP bind credential is resolved through it), never +the reverse, so a tool that only needs secrets can depend on `secrets-rs` alone. --- @@ -51,15 +51,15 @@ than their pinned toolchain must fail here, not in their builds. unified-api and unified-gitops name a release tag of this repository in their `Cargo.toml`. ```toml -unified-secrets = { git = "https://github.com/OpusProjects/auth", tag = "v0.1.0" } -unified-auth = { git = "https://github.com/OpusProjects/auth", tag = "v0.1.0" } +secrets-rs = { git = "https://github.com/OpusProjects/auth", tag = "v0.1.0" } +auth-rs = { git = "https://github.com/OpusProjects/auth", tag = "v0.1.0" } ``` Both lines name the same tag: the crates are released together. The services' `deny.toml` allows this one git source (`[sources] allow-git`), which every other git dependency is refused by. Moving a service to a new release is a `build:` pull request in the service that changes both tags -and its `Cargo.lock` (`cargo update -p unified-secrets -p unified-auth`). +and its `Cargo.lock` (`cargo update -p secrets-rs -p auth-rs`). --- @@ -72,8 +72,8 @@ With auth checked out next to the service, add a `[patch]` section to the servic ```toml [patch."https://github.com/OpusProjects/auth"] -unified-secrets = { path = "../auth/crates/unified-secrets" } -unified-auth = { path = "../auth/crates/unified-auth" } +secrets-rs = { path = "../auth/crates/secrets-rs" } +auth-rs = { path = "../auth/crates/auth-rs" } ``` Then run the service's own gates (`cargo clippy --all-targets -- -D warnings` and `cargo test`): @@ -86,10 +86,10 @@ section before committing anything in the service. New code goes in the crate whose job it is, with its tests in the same file. -- **A new secrets backend:** a `SecretsPort` adapter in `unified-secrets`, and a route to it in +- **A new secrets backend:** a `SecretsPort` adapter in `secrets-rs`, and a route to it in `chain.rs`. The YAML fields it adds belong on `Credential`, strict like the rest. - **A new way to sign in:** a `DirectoryPort` adapter, or a new use case beside `login.rs`, in - `unified-auth`; a new way to authenticate a request belongs in its `http` module. + `auth-rs`; a new way to authenticate a request belongs in its `http` module. - **Anything one service needs and the other does not:** in that service, not here. Every new line comes with the test that runs it; see [Tests and coverage](#tests-and-coverage). @@ -103,8 +103,8 @@ Every line of both crates runs in a test, and the `test` check fails a pull requ | Where | What goes there | |---|---| | `#[cfg(test)] mod tests` at the bottom of a file in `src/` | Unit tests of that file, including its private functions | -| `crates/unified-secrets/tests/vault_test.rs` | The Vault adapter against a fake Vault: a few axum routes on `127.0.0.1` | -| `crates/unified-auth/tests/ldap_directory_test.rs` | The LDAP adapter against a fake directory that speaks just enough LDAP (bind, search, unbind) | +| `crates/secrets-rs/tests/vault_test.rs` | The Vault adapter against a fake Vault: a few axum routes on `127.0.0.1` | +| `crates/auth-rs/tests/ldap_directory_test.rs` | The LDAP adapter against a fake directory that speaks just enough LDAP (bind, search, unbind) | The suite needs no directory, Vault or network. Test code under `tests/` is not counted by `cargo llvm-cov`, which is why the two fakes live there: their own error handling would otherwise diff --git a/docs/releasing.md b/docs/releasing.md index e2007e8..920a434 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -151,11 +151,11 @@ gh workflow run build.yaml --ref release-please--branches--main A release here changes nothing in the services until each one names the new tag. In unified-api and unified-gitops, open a `build:` pull request (`build: move to auth v0.2.0`) that -changes the `tag` of both `unified-secrets` and `unified-auth` in `Cargo.toml` and refreshes the +changes the `tag` of both `secrets-rs` and `auth-rs` in `Cargo.toml` and refreshes the lockfile: ```bash -cargo update -p unified-secrets -p unified-auth +cargo update -p secrets-rs -p auth-rs ``` The service's CI is the check that the release works there. A release that changes what a person diff --git a/docs/secrets.md b/docs/secrets.md index 4a3c105..9df61cb 100644 --- a/docs/secrets.md +++ b/docs/secrets.md @@ -1,6 +1,6 @@ # Secrets -The `unified-secrets` crate: how a service turns a credential item into the values a script or a +The `secrets-rs` crate: how a service turns a credential item into the values a script or a login needs. The principle every service follows: **configuration never holds a secret**. A credential describes *where* each value lives, and the infrastructure (env vars, mounted files, @@ -31,7 +31,7 @@ The crate is a port, its adapters, and the one function that wires them together | `chain` | `build_chain` and `SecretsConfig`, the deprecated `secrets:` block of `config.yaml` | | `mock` | `MockSecrets`, the test double | -The names a service uses most are re-exported at the crate root: `unified_secrets::{Credential, +The names a service uses most are re-exported at the crate root: `secrets_rs::{Credential, CredentialType, SecretsPort, SecretsError, SecretsConfig, build_chain}`. --- @@ -64,7 +64,7 @@ A service builds one `SecretsPort` from its loaded credentials, and resolves eve ```rust let secrets: Arc = - unified_secrets::build_chain(&config.credentials, &config.secrets_config); + secrets_rs::build_chain(&config.credentials, &config.secrets_config); let values = secrets.resolve("cred-vcenter-aa1").await?; // {"username": ..., "password": ...} ``` @@ -113,7 +113,7 @@ chain with one built from the new configuration. Resolutions already running fin `MockSecrets` answers from a map, so a service's tests need no environment variables or Vault. ```rust -let secrets = unified_secrets::mock::MockSecrets::new() +let secrets = secrets_rs::mock::MockSecrets::new() .with("cred-ldap", [("username", "CN=svc"), ("password", "secret")]); ``` diff --git a/docs/sign-in.md b/docs/sign-in.md index 37bfe33..2cc4b52 100644 --- a/docs/sign-in.md +++ b/docs/sign-in.md @@ -1,6 +1,6 @@ # Sign-in -The `unified-auth` crate: signing a person in with their directory account (LDAP or Active +The `auth-rs` crate: signing a person in with their directory account (LDAP or Active Directory), deciding what that gets them through the service's own access rules, and authenticating every request after that, by API key or by browser session. @@ -33,7 +33,7 @@ A port, its LDAP adapter, the configuration block and the use case that joins th | `http::session` | `SessionStore

`, `SessionKind`, `form_action`, `csrf_matches`, `cookie_value`, `new_token` | | `http` | The `Permission` trait each service's permissions type implements | -The bind credential is resolved through a `unified_secrets::SecretsPort`, like any other credential. +The bind credential is resolved through a `secrets_rs::SecretsPort`, like any other credential. --- @@ -47,7 +47,7 @@ rule grants is not: unified-api's restricted rules list `sources` and `endpoints list `applications`. So each service keeps its own rule struct and names the block with it: ```rust -pub type LdapConfig = unified_auth::LdapConfig; // in the service's domain/ldap.rs +pub type LdapConfig = auth_rs::LdapConfig; // in the service's domain/ldap.rs ``` The block stays strict: it carries `deny_unknown_fields`, and so should the service's rule type. @@ -60,11 +60,11 @@ The block stays strict: it carries `deny_unknown_fields`, and so should the serv A service's rule type implements one trait: given every rule and one person, what do they get. ```rust -impl unified_auth::AccessRule for AccessRule { +impl auth_rs::AccessRule for AccessRule { type Grant = Grant; // the service's own: Admin, or the ids a restricted rule lists fn grant_for(rules: &[Self], username: &str, member_of: &[String]) -> Option { - // for each rule with unified_auth::rule_names(&rule.users, &rule.groups, username, member_of): + // for each rule with auth_rs::rule_names(&rule.users, &rule.groups, username, member_of): // admin anywhere is admin; otherwise union the scoped lists } } @@ -167,19 +167,19 @@ for a request that carries the session cookie, so a cross-site form cannot reach A service names its own permissions type and cookie, and keeps its error shape and its pages. ```rust -impl unified_auth::http::Permission for Permissions { +impl auth_rs::http::Permission for Permissions { fn admin() -> Self { Permissions::Admin } } -pub type ApiKeys = unified_auth::http::ApiKeys; -pub type AuthContext = unified_auth::http::AuthContext; +pub type ApiKeys = auth_rs::http::ApiKeys; +pub type AuthContext = auth_rs::http::AuthContext; // `middleware::from_fn` takes a function of the request and `next`: this // passes the cookie name and renders a refusal as the service's ApiError. pub async fn require_api_key(request: Request, next: Next) -> Result { - unified_auth::http::require_api_key::(COOKIE_NAME, request, next) + auth_rs::http::require_api_key::(COOKIE_NAME, request, next) .await .map_err(ApiError::from) }