2Fa, event hooks, sms, custom hashing? Scattered ideas.

[howesteve]

Hello,

First, nice project, thanks.

I'd like to know if some features are in the roadmap. I'm not demanding anything of course, just want to plan on my side.

1. Are 2FA (ou MFA) planned?
2. Plugable password hashing? I'd rather use argon2 instead of bcrypt (current implementation), but not a deal breaker. Argon is more future proof specially against GPU attacks. This should be easy to implement through a single trait.
3. An event hooks system could be nice. For instance, I'd like to implement a blacklist for my revoked JWT tokens. My apps are usually single node using sqlite with high traffic, so I just keep them in a memory array, thus avoiding database lookups, and sync them into database as they come, so I can reload them until they just expire and I don' t need to keep track of them. But, it could be implemented using redis, saved into the database, or whatever. So, hooking on "authentication event" to re-confirm if it's ok would be nice. These kind of events could make it very flexible.
4. SMS confirmation/magic links? They would be specially useful on 2FA.
5. The mailer system using lettre is nice, but it could also be a more generic system, allowing plugable notify systems such as sms, whatsapp, telegram, etc.
6. A nitpick: I think the (ip, user) returned by .password().authenticate() could be a single object. It' s not very nice returning a tuple, and if we'd like to add any custom data, it's hard as it is. I'd model it as {ip, user_agent, metadata} => metadata being a generic or a serde_json::Value (could be saved into db this way), whatever.

Thanks,
Howe

[cmackenzie1]

Hey @howesteve, thanks for checking out Torii and for the thoughtful questions!

A bit of context: this is a hobby project I work on when time permits or when I need specific functionality for my own services. It's still alpha and intentionally opinionated to keep maintenance manageable. With that in mind:

1. 2FA/MFA — No current plans, but it's something I could see adding down the road if I need it myself.
2. Password hashing — Good news here! The password-auth crate already uses Argon2 by default, so Torii should have the behavior you're looking for. https://lib.rs/crates/password-auth
3. Event hooks — This is on my radar. There's some early groundwork in torii-core/src/events.rs, but the API isn't finalized and events aren't consistently emitted yet. Your JWT blacklist use case is a good example of what I'd want to support eventually.
4. SMS/magic links — No plans currently.
5. Pluggable notification system — I'm trying to keep third-party dependencies minimal. Databases and mail (via Lettre) feel like reasonable core dependencies since they're broadly applicable, but adding SMS, WhatsApp, Telegram, etc. introduces a lot of provider-specific integration work that's hard to maintain as a solo hobby project. If the event system (point 3) matures, that could be a path for users to plug in their own notification logic without it living in core.
6. Return type for authenticate() — Agreed, the tuple is awkward. I'm open to moving this into a proper struct with Serialize/Deserialize. If you'd like to open a PR or issue for this, I'd be happy to discuss it further.

Appreciate you sharing your use cases. It is helpful to know what others are looking for, even if I can't commit to timelines.