crabidy/plan/roles-auth.md

Plan — roles and rights

From architecture/roles-auth.md and quality/roles-auth.md.

• Deps: workspace argon2 (with std), http, tower; crabidy-server gains argon2, base64, http, tower, clap; cbd-tui gains base64. Verify: workspace builds.
• Server settings (crabidy-server/src/settings.rs): ServerSettings { auth: AuthSettings }, AuthSettings { owner, queue_owner, queue_appender: Option<String> }; load(config_dir) — absent file ⇒ defaults, malformed file ⇒ startup error. Verify: unit tests for all three cases.
• Auth core (crabidy-server/src/auth.rs): Role (ordered), minimum_role(method) -> Role default-deny table, Authenticator (parse Basic header, argon2 verify, success cache, disabled mode). Verify: unit tests — header parsing never panics, wrong user/password indistinguishable, matrix samples per role, unknown method ⇒ owner, cache fed only by successes, disabled mode allows all without header.
• Tower layer (auth.rs): AuthLayer/AuthService checking authorization against the method's minimum role before the inner service; denials answer trailers-only via Status::into_http(). Verify: service-level tests with a counting inner service (deny short-circuits, allow forwards, unauthenticated vs permission-denied codes).
• Wire-up (lib.rs::serve): load settings, fail startup on malformed config, install the layer. Verify: existing tests still pass; layer test covers enforcement.
• hash-password (main.rs + clap): subcommand reads stdin, prints PHC string; round-trip test hash → authenticator accepts.
• Client (cbd-tui): user/password config options (and flags), auth interceptor attaching a precomputed Basic header to every request, type alias for the intercepted client. Verify: unit tests — no creds ⇒ no header, creds ⇒ header present.
• Docs: root README (config table row, cbd-tui.toml options, security note), new crabidy-server.toml section; architecture cross-links. Verify: markdownlint.
• Gates: run the full suite + clippy + fmt; check off quality/roles-auth.md; write plan/summary.md section.