arete_auth/
lib.rs

1//! Arete Authentication Library
2//!
3//! This crate provides authentication and authorization utilities for Arete,
4//! including JWT token handling, claims validation, and key management.
5
6pub mod audience;
7pub mod audit;
8pub mod claims;
9pub mod error;
10pub mod keys;
11pub mod metrics;
12pub mod multi_key;
13pub mod program_read;
14pub mod revocation;
15pub mod solana_gateway;
16pub mod token;
17pub mod verifier;
18
19pub use audience::{AudienceSet, AudienceSetError};
20pub use audit::{
21    auth_failure_event, auth_success_event, rate_limit_event, AuditEvent, AuditSeverity,
22    ChannelAuditLogger, NoOpAuditLogger, SecurityAuditEvent, SecurityAuditLogger,
23};
24pub use claims::{
25    AuthContext, KeyClass, Limits, PolicyClaimsError, SessionClaims, TargetKind,
26    MAX_POLICY_IDENTITY_BYTES, PLAN_ANONYMOUS,
27};
28pub use error::{AuthError, AuthErrorCode, RetryPolicy, VerifyError};
29pub use keys::{KeyLoader, SigningKey, VerifyingKey};
30pub use metrics::{AuthMetrics, AuthMetricsCollector, AuthMetricsSnapshot};
31pub use multi_key::{MultiKeyVerifier, MultiKeyVerifierBuilder, RotationKey};
32pub use program_read::{ProgramReadAuthorization, ProgramReadAuthorizationError};
33pub use revocation::{RevocationChecker, TokenRevocationList};
34pub use solana_gateway::{
35    SolanaGatewayAuthorization, SolanaGatewayAuthorizationError, SolanaGatewayScope,
36};
37pub use token::{TokenError, TokenSigner, TokenVerifier};
38pub use verifier::{AsyncVerifier, SimpleVerifier};
39
40/// Stable JWT audience for the shared program-read service.
41pub const PROGRAM_READ_AUDIENCE: &str = "arete:program-read";
42
43/// Stable JWT audience shared by all regional Solana gateways.
44pub const SOLANA_GATEWAY_AUDIENCE: &str = "arete:solana-gateway";
45
46/// Exact scope for chain reads.
47pub const SCOPE_READ: &str = "read";
48
49/// Exact scope for transaction inspection operations.
50pub const SCOPE_TRANSACTION_INSPECT: &str = "transaction:inspect";
51
52/// Exact scope for transaction submission.
53pub const SCOPE_TRANSACTION_SEND: &str = "transaction:send";
54
55/// Default session token TTL in seconds (5 minutes)
56pub const DEFAULT_SESSION_TTL_SECONDS: u64 = 300;
57
58/// Refresh window in seconds before expiry (60 seconds)
59pub const DEFAULT_REFRESH_WINDOW_SECONDS: u64 = 60;
arete_auth/lib.rs

arete_auth/
lib.rs
