Struct Auth 

pub struct Auth { /* private fields */ }

Gatekeeper for control actions: it issues pairing challenges and verifies commands.

Implementations

impl Auth

pub fn new(secret: impl Into<String>) -> Self

Creates an authenticator for a pairing secret.

Arguments

• secret - the canonical pairing secret string (the client normalizes a typed code to the same value).

Returns

An authenticator with no sessions yet.

pub fn generate_secret() -> String

Generates a fresh high-entropy pairing secret as lowercase hex.

Returns

A 128-bit secret rendered as 32 hex characters.

pub fn challenge(&self) -> Challenge

Starts a pairing exchange, returning a challenge and recording an unconfirmed session.

Returns

The Challenge to send to the client.

pub fn confirm(&self, session_id: &str, mac_hex: &str) -> Result<(), AuthError>

Confirms a pairing by checking the client proved it derived the session key.

Arguments

• session_id - the challenge’s session id.
• mac_hex - HMAC(key, "confirm\n" + session_id) as lowercase hex.

Returns

Ok(()) if the proof is valid and the session is now paired.

Errors

AuthError::UnknownSession, AuthError::Expired, or AuthError::BadMac.

pub fn verify_command( &self, session_id: &str, counter: u64, command: &str, mac_hex: &str, ) -> Result<(), AuthError>

Verifies an authenticated command and advances the session’s replay counter.

The MAC covers the counter and the exact command string, so the server checks the same bytes the client signed without re-serializing.

Arguments

• session_id - the paired session’s id.
• counter - the strictly increasing per-session command counter.
• command - the exact command payload string the client signed.
• mac_hex - HMAC(key, counter + "\n" + command) as lowercase hex.

Returns

Ok(()) if the command is authentic and fresh; the counter is then recorded.

Errors

AuthError::UnknownSession, AuthError::NotPaired, AuthError::Expired, AuthError::Replayed, or AuthError::BadMac.