Authentication Module

auth.rs (388 lines) — Proton SRP authentication using the proton-srp crate.

Status

auth.rs implements a complete SRP authentication flow but is not currently wired into main.rs — there is no mod auth; declaration. It may be intended for future integration or was designed as a standalone library module.

SRP Authentication Flow

sequenceDiagram
    participant Client as auth.rs (AuthManager)
    participant API as Proton API (mail.proton.me)
    
    Client->>API: POST /api/auth/v4/info
    Note over Client,API: Send username, get SRP parameters
    API-->>Client: modulus, server_ephemeral, salt, version, SRPSession
    
    Client->>Client: Generate SRP proofs (client_ephemeral, client_proof)
    
    Client->>API: POST /api/auth/v4
    Note over Client,API: Send username + proofs
    API-->>Client: access_token, refresh_token, server_proof
    
    Client->>Client: Verify server_proof
    
    alt 2FA Enabled
        Client->>API: POST /api/auth/v4/2fa
        Note over Client,API: Submit TOTP code
        API-->>Client: Verified
    end
    
    Client->>Client: Store AuthSession

Key Structures

Structure	Purpose
`AuthManager`	Core auth state machine: HTTP client, base URL, session lock, pending 2FA lock
`AuthSession`	Session tokens: `uid`, `access_token`, `refresh_token`, `token_type`
`AuthError`	Error variants: Network, Srp, InvalidResponse, TwoFactorRequired, InvalidCredentials, NotAuthenticated, HumanVerificationRequired

AuthManager API

Method	Description
`new(base_url)`	Creates manager with `reqwest::Client` (no redirects)
`login(username, password)`	Full SRP login: get auth info → generate proofs → submit → verify server proof → handle 2FA
`submit_2fa(totp_code)`	Submits TOTP code for pending 2FA session
`refresh_token()`	Refreshes expired access token via `/api/auth/v4/refresh`
`get_session()`	Returns current session (if authenticated)
`set_session(session)`	Restores session from persistent storage
`logout()`	Invalidates session and clears state

Session Management

Sessions are stored in a tokio::sync::RwLock<Option<AuthSession>> for thread-safe access
Pending 2FA state is held in a separate RwLock<Option<Pending2FA>> so the partial auth state is preserved while waiting for the TOTP code
Token refresh posts to /api/auth/v4/refresh with the current refresh token
All API requests use the x-pm-appversion: web-drive@5.0.0 header

Cookie Integration (elsewhere)

When auth is wired in, session tokens flow to the WebView via webview_cookies.rs, which bridges the reqwest cookie jar (where tokens land after login) with WebKit’s native cookie store for persistent “Keep me signed in” across app restarts.