How ToPreviewFor developerFor agency

Add Rust JSON and secure application support

Update an existing Rust module with JSON parsing, password verification and secure random bytes.

Last updated 2026-10-29

What you'll achieve

Update an existing SDK-only Rust module
Preserve complete offline dependency locks
Use supported password and secure-random primitives

Add JSON and secure application primitives

The Rust app-support package provides JSON parsing and serialization, password hashing and verification, and secure random bytes. It extends the BlinkHost Rust SDK without changing its version. Your compiler and runtime must support app-support version 0.1.0; existing modules are not upgraded automatically.

Use this package in the existing module. You do not need to create a replacement module, database, or deployment. Keep your application source and resource bindings.

Update an existing SDK-only module

First inspect the module's Cargo.toml, complete Cargo.lock, and source files. If its only dependency is blinkhost-sdk version 1.1.0, add this entry under [dependencies] and retain the existing SDK entry:

blinkhost-app-support = { path = "/opt/blinkhost-sdk/app-support", version = "=0.1.0" }

Use the complete lockfile below for this SDK-only dependency graph. In its root application package entry, replace blinkhost-rust-conformance-app-support with the existing [package].name and replace that entry's 0.1.0 with the existing [package].version. Do not change the versions, dependencies, sources or checksums of the SDK, support package or registry packages. Preserve the existing application name and version rather than renaming the module to match the example.

This template is for a single package with only these two direct dependencies. If the module has other dependencies, workspace members, patches, or dependency feature settings, do not replace its lockfile with this smaller graph. Preserve those requirements and generate a compatible complete lockfile using Cargo with the available vendored sources. Registry access is unavailable during the build; an unavailable dependency must be resolved before compilation. Do not invent checksums, guess transitive versions, or remove unrelated packages to make a lockfile look complete.

Idam can read this guide through the documentation page resource backend-modules/rust-app-support, inspect the existing files, and propose the manifest, lockfile and source changes through its normal source-edit workflow. Review and apply those changes to the existing module, then build and validate it. Do not change managed module identity files.

Complete SDK-only lockfile

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4

[[package]]
name = "blinkhost-app-support"
version = "0.1.0"
dependencies = [
 "serde_json",
]

[[package]]
name = "blinkhost-rust-conformance-app-support"
version = "0.1.0"
dependencies = [
 "blinkhost-app-support",
 "blinkhost-sdk",
]

[[package]]
name = "blinkhost-sdk"
version = "1.1.0"

[[package]]
name = "itoa"
version = "1.0.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"

[[package]]
name = "memchr"
version = "2.8.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

[[package]]
name = "proc-macro2"
version = "1.0.107"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
dependencies = [
 "unicode-ident",
]

[[package]]
name = "quote"
version = "1.0.47"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
dependencies = [
 "proc-macro2",
]

[[package]]
name = "serde"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
dependencies = [
 "serde_core",
]

[[package]]
name = "serde_core"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
dependencies = [
 "serde_derive",
]

[[package]]
name = "serde_derive"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
dependencies = [
 "proc-macro2",
 "quote",
 "syn",
]

[[package]]
name = "serde_json"
version = "1.0.154"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
dependencies = [
 "itoa",
 "memchr",
 "serde",
 "serde_core",
 "zmij",
]

[[package]]
name = "syn"
version = "3.0.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
dependencies = [
 "proc-macro2",
 "quote",
 "unicode-ident",
]

[[package]]
name = "unicode-ident"
version = "1.0.27"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"

[[package]]
name = "zmij"
version = "1.0.23"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

Use the supported APIs

use blinkhost_app_support::{
    parse_json, json_string, json, Value,
    hash_password, verify_password, PasswordVerification, secure_random,
};

parse_json(&[u8]) returns a decoded JSON value and json_string(&Value) serializes a value. Each accepts at most 1 MiB of encoded JSON. Use these APIs rather than manually splitting or interpolating JSON.

hash_password(&str) creates an Argon2id password hash with an operating-system-generated salt. verify_password(password, encoded_hash) returns Mismatch, Match, or MatchNeedsRehash. A rehash result means verification succeeded against an older supported hash policy; update the stored hash using the verified password. An error never means authentication succeeded. Never hash the password again and compare the encoded strings: salts differ.

secure_random::<32>() and secure_random::<64>() obtain bytes from the host operating system's cryptographic random generator. Encode these bytes safely when using them as opaque tokens; never put secrets in logs, URLs or frontend source. Do not substitute WASI randomness, timestamps or counters for session secrets.

Password and encoded-hash inputs are limited to 256 bytes. A single invocation permits four combined password hash/verify calls and 32 secure-random calls. These operations require the signed hashing capability. Busy means the host cannot admit more password work; return a retryable response without weakening verification. Invalid, denied, limited, cancelled and internal errors must also fail closed.

Build and verify the application

The compiler includes the pinned package, its full vendored dependencies and Cargo configuration. It builds with --offline --locked for wasm32-wasip1. Both existing SDK-only modules and explicitly updated app-support modules remain supported.

The package supplies primitives, not an entire authentication system. Your app still owns session storage, expiry, logout, CSRF protection and authorization for every protected record. Follow secure application sessions when using browser cookies. Verify sign-in and protected data operations on the published application; a successful frontend-only preview does not prove authentication works.