Chapter 6 — Auth + permissions

7 live tests on the password / API-key / JWT / permission primitives. No DB needed — pure crypto. Run with cargo test --test cookbook_chapter06_auth.

$ cargo test --test cookbook_chapter06_auth
test result: ok. 7 passed; 0 failed; 0 ignored

• §6.83 passwords::hash (Argon2 with random salt) + passwords::verify round-trip + strength_score issue list. → passwords_hash_and_verify_round_trip, passwords_strength_score_flags_weak
• §6.84 api_keys::generate_key() → (token, prefix, hash). split_token(token) → (prefix, secret). verify_key(secret, hash). → api_keys_issue_then_verify
• §6.85 jwt::Claims::new(sub).issuer(...).audience(...).ttl(...) → encode(&claims, secret) → token. decode(&token, secret) rejects wrong-secret + tampered tokens; decode_at(&token, secret, now) rejects expired tokens. → jwt_round_trips_with_ttl_and_subject, jwt_rejects_wrong_secret_and_tampered_token, jwt_decode_at_rejects_expired_token
• §6.78 / 6.79 permissions::codename_for::<T>("view"|"add"|"change"|"delete") → Django-shape {app}.{action}_{model} strings. → permission_codename_for_model_resolves_app_action_model