# Parts

> Tested, security-reviewed kernel code for Rust off Rails 0.7.3: mail, a job queue, sign-in, realtime and the dev tools. Add one with `cargo offrails add <part>` (its dependencies come first); `cargo offrails parts` lists what's installed.

## auth-core

Accounts and sessions every auth sample shares: users, database sessions with rotation and revocation, an account security page (devices, activity), re-auth for sensitive actions, email change, security emails with a 'this wasn't me' link, an audit trail and progressive throttling

- Gives you: Database sessions; An account security page; Re-authentication ("sudo mode"); Email change; Security emails; An audit trail; Progressive throttling; Open or invite-only sign-up, one switch for every method; Return-to
- Requires: mailer and dev-mailbox
- Add it: `cargo offrails add auth-core`
- README: https://rustoffrails.org/parts/auth-core.md

## auth-magic-link

Passwordless sign-in: an emailed link plus a 6-digit code (for phones that open links elsewhere), single-use, hashed, 15 minutes, bound to the asking browser, race-safe, sign-up on first use, re-auth by emailed code, and the dev mailbox hint

- Gives you: A link and a code in one email; Single-use, hashed, 15-minute; Race-safe; Scanner-safe; Bound to the asking browser, by default; 5 wrong codes burn the link; Pre-hijacking safe with passwords; No enumeration; Open or invite-only; Re-auth by emailed code; The dev mailbox hint
- Requires: auth-core
- Add it: `cargo offrails add auth-magic-link`
- README: https://rustoffrails.org/parts/auth-magic-link.md

## auth-password

Email + password: argon2id (OWASP parameters, rehash on sign-in), sign-up with email verification, sign-in with progressive per-account delays, reset by single-use link, change password, a bundled common-password check and a live strength meter that works without JS

- Gives you: argon2id with OWASP's parameters; Sign-up that never reveals existing accounts; Pre-hijacking defense; Sign-in with no enumeration; Progressive delays per account; Reset by single-use, hashed, 30-minute links; Open or invite-only; Change password; Passwords people can live with; A strength meter that works without JavaScript
- Requires: auth-core
- Add it: `cargo offrails add auth-password`
- README: https://rustoffrails.org/parts/auth-password.md

## auth-totp

Two-factor authentication (TOTP, RFC 6238): enrol with a server-side QR code or setup key, confirm before enable, a code step after any sign-in method, replay protection, 10 hashed recovery codes, 'trust this device for 30 days', re-auth with a code, secrets encrypted at rest

- Gives you: Enrolment with a QR code generated on the server; A pending sign-in step; Replay protection; 10 recovery codes; "Don't ask again on this device for 30 days"; Step-up; Limits; Secrets encrypted at rest
- Requires: auth-core
- Add it: `cargo offrails add auth-totp`
- README: https://rustoffrails.org/parts/auth-totp.md

## dev-dashboard

/dev/dashboard, an in-process LiveDashboard: live charts (memory, CPU, req/s, p50/p95/p99, errors, DB pool, Tokio), requests per route, traces as waterfalls, SQL fingerprints with N+1 and EXPLAIN, a live log tail, insights, a routes explorer, an interactive schema diagram (ERD) with a migrations timeline and drift checks, an optional bring-your-own-key AI assistant, test runs and CI, a load lab, Upstreams (the APIs the app calls through its outbound wrapper, with a dependency map), Security (attack and abuse detectors with an attack simulator) and Frontend (rage and dead clicks, JS errors and Web Vitals from a browser beacon). Development only; a read-only subset for admins in production.

- Gives you: AI command center; Overview; Charts; Requests; Traces, an explorer on one screen; The waterfall; Upstreams; Security; Frontend; Methods; Hot functions; History on disk; SQL; Logs; Insights; Routes; Schema; Migrations; Ask AI, an agent; Health and "what am I looking at"; Proactive; Tests; GitHub; Load lab; Config; For agents; It costs little; Development only
- Requires: nothing
- Add it: `cargo offrails add dev-dashboard`
- README: https://rustoffrails.org/parts/dev-dashboard.md

## dev-mailbox

A live local inbox at /dev/mailbox: HTML/text/raw/headers, width and dark previews, codes and links with copy, attachments, search, checks, previews, JSON and a CLI. Development only.

- Gives you: Live inbox; Message view; Desktop, 600 px, 320 px and Dark; Codes and links; Checks; Attachments; Search; Mailer previews; Keyboard; For agents and tests; It styles itself; Development only
- Requires: mailer
- Add it: `cargo offrails add dev-mailbox`
- README: https://rustoffrails.org/parts/dev-mailbox.md

## jobs

A DB-backed job queue (Oban-style): SKIP LOCKED / single-writer claims, typed args, retries with exponential backoff and jitter, unique jobs, priorities, scheduled and cron jobs, rate-limited queues, batches, timeouts, orphan rescue, graceful shutdown, pruning, an inline worker and an `app jobs` CLI

- Gives you: Typed jobs; Correct claiming on both backends; Retries; Outcomes; Scheduling; Queues; Batches; Progress; Safety; Tooling; Tests
- Requires: nothing
- Add it: `cargo offrails add jobs`
- README: https://rustoffrails.org/parts/jobs.md

## jobs-dashboard

/admin/jobs: live overview (state counters, throughput and queue-wait charts, now-running lane with progress, queues with pause/resume, worker success rates, nodes), job list with filters, search and bulk actions, job detail with timeline and errors per attempt, error groups, cron with run-now; admin-only, CSRF-protected, light and dark, keyboard and mobile friendly

- Gives you: Overview; Jobs; Job; Errors; Cron; Pause all; Keyboard; Looks right everywhere; Safe
- Requires: jobs
- Add it: `cargo offrails add jobs-dashboard`
- README: https://rustoffrails.org/parts/jobs-dashboard.md

## mailer

Mailer: templated HTML + text email, delivery adapters (SMTP, dev mailbox storage, log, memory), previews, a test email task

- Requires: nothing
- Add it: `cargo offrails add mailer`
- README: https://rustoffrails.org/parts/mailer.md

## realtime

Channels over WebSocket (offrails.v1) with SSE and long-poll fallbacks: typed rooms, topic authorization on every join and push, presence across tabs and nodes, resume after reconnect, signed socket tokens, revocation, per-user caps, tuned buffers, a live room demo and /dev/sockets

- Gives you: Protocol; Transports; Who's connecting; Authorization; Revocation; Limits; Presence; Server API; Demo; /dev/sockets
- Requires: nothing
- Add it: `cargo offrails add realtime`
- README: https://rustoffrails.org/parts/realtime.md