Module nonce_cache 

A bounded single-use nonce cache for short-lived HMAC tickets.

An HMAC ticket on its own is a bearer token: anyone who observes one can present it again until it expires. The relay lane is a broadcast every fleet member hears, and a WebSocket ticket travels in a subprotocol header that can surface in logs, so both need “this exact ticket has already been spent” as well as “this ticket is authentic”.

The cache remembers each admitted nonce until the ticket that carried it can no longer verify anyway, and never for less than a fixed retention. It is bounded: past its capacity the oldest entry is evicted. Only tickets that already passed their HMAC check reach the cache, so filling it requires the signing key, and an eviction cannot be forced by a stranger.

Structs

NonceCache

Remembers spent nonces. Cheap to share behind a &'static or an Arc.

Functions

random_nonce_hex

Sixteen random bytes as lowercase hex, for a ticket nonce. None only when the operating system cannot supply randomness, in which case no ticket should be minted at all.