arete_auth/
lib.rs

1//! Arete Authentication Library
2//!
3//! This crate provides authentication and authorization utilities for Arete,
4//! including JWT token handling, claims validation, and key management.
5
6pub mod audience;
7pub mod audit;
8pub mod claims;
9pub mod error;
10pub mod keys;
11pub mod metrics;
12pub mod multi_key;
13pub mod program_read;
14pub mod revocation;
15pub mod solana_gateway;
16pub mod token;
17pub mod verifier;
18
19pub use audience::{AudienceSet, AudienceSetError};
20pub use audit::{
21    auth_failure_event, auth_success_event, rate_limit_event, AuditEvent, AuditSeverity,
22    ChannelAuditLogger, NoOpAuditLogger, SecurityAuditEvent, SecurityAuditLogger,
23};
24pub use claims::{
25    AuthContext, KeyClass, Limits, PolicyClaimsError, SessionClaims, TargetKind,
26    MAX_POLICY_IDENTITY_BYTES, PLAN_ANONYMOUS,
27};
28pub use error::{AuthError, AuthErrorCode, RetryPolicy, VerifyError};
29pub use keys::{KeyLoader, SigningKey, VerifyingKey};
30pub use metrics::{AuthMetrics, AuthMetricsCollector, AuthMetricsSnapshot};
31pub use multi_key::{MultiKeyVerifier, MultiKeyVerifierBuilder, RotationKey};
32pub use program_read::{ProgramReadAuthorization, ProgramReadAuthorizationError};
33pub use revocation::{RevocationChecker, TokenRevocationList};
34pub use solana_gateway::{
35    SolanaGatewayAuthorization, SolanaGatewayAuthorizationError, SolanaGatewayScope,
36};
37pub use token::{TokenError, TokenSigner, TokenVerifier};
38pub use verifier::{AsyncVerifier, SimpleVerifier};
39
40/// Stable JWT audience for the shared program-read service.
41pub const PROGRAM_READ_AUDIENCE: &str = "arete:program-read";
42
43/// Stable JWT audience shared by all regional Solana gateways.
44pub const SOLANA_GATEWAY_AUDIENCE: &str = "arete:solana-gateway";
45
46/// Exact scope for chain reads.
47pub const SCOPE_READ: &str = "read";
48
49/// Exact scope for transaction inspection operations.
50pub const SCOPE_TRANSACTION_INSPECT: &str = "transaction:inspect";
51
52/// Exact scope for transaction submission.
53pub const SCOPE_TRANSACTION_SEND: &str = "transaction:send";
54
55/// Exact scope for the read-only fork JSON-RPC endpoint (`POST /rpc/v1/fork`).
56///
57/// Independent from [`SCOPE_READ`]: a fork session may forward a bounded,
58/// allowlisted set of read methods to the gateway's read RPC, and nothing else.
59pub const SCOPE_FORK_READ: &str = "fork:read";
60
61/// Default session token TTL in seconds (5 minutes)
62pub const DEFAULT_SESSION_TTL_SECONDS: u64 = 300;
63
64/// Refresh window in seconds before expiry (60 seconds)
65pub const DEFAULT_REFRESH_WINDOW_SECONDS: u64 = 60;
arete_auth/lib.rs

arete_auth/
lib.rs
