arete_auth/
lib.rs

1//! Arete Authentication Library
2//!
3//! This crate provides authentication and authorization utilities for Arete,
4//! including JWT token handling, claims validation, and key management.
5
6pub mod audience;
7pub mod audit;
8pub mod claims;
9pub mod error;
10pub mod keys;
11pub mod metrics;
12pub mod multi_key;
13pub mod program_read;
14pub mod revocation;
15pub mod sealed;
16pub mod solana_gateway;
17pub mod token;
18pub mod verifier;
19
20pub use audience::{AudienceSet, AudienceSetError};
21pub use audit::{
22    auth_failure_event, auth_success_event, rate_limit_event, AuditEvent, AuditSeverity,
23    ChannelAuditLogger, NoOpAuditLogger, SecurityAuditEvent, SecurityAuditLogger,
24};
25pub use claims::{
26    AuthContext, KeyClass, Limits, PolicyClaimsError, SessionClaims, TargetKind,
27    MAX_POLICY_IDENTITY_BYTES, PLAN_ANONYMOUS,
28};
29pub use error::{AuthError, AuthErrorCode, RetryPolicy, VerifyError};
30pub use keys::{KeyLoader, SigningKey, VerifyingKey};
31pub use metrics::{AuthMetrics, AuthMetricsCollector, AuthMetricsSnapshot};
32pub use multi_key::{MultiKeyVerifier, MultiKeyVerifierBuilder, RotationKey};
33pub use program_read::{ProgramReadAuthorization, ProgramReadAuthorizationError};
34pub use revocation::{RevocationChecker, TokenRevocationList};
35pub use sealed::{
36    seal_claims, unseal_claims, ClaimSealKey, ClaimSealKeys, SealError, ACCOUNT_CLAIMS,
37    SEALED_CLAIM,
38};
39pub use solana_gateway::{
40    SolanaGatewayAuthorization, SolanaGatewayAuthorizationError, SolanaGatewayScope,
41};
42pub use token::{TokenError, TokenSigner, TokenVerifier};
43pub use verifier::{AsyncVerifier, SimpleVerifier};
44
45/// Stable JWT audience for the shared program-read service.
46pub const PROGRAM_READ_AUDIENCE: &str = "arete:program-read";
47
48/// Stable JWT audience shared by all regional Solana gateways.
49pub const SOLANA_GATEWAY_AUDIENCE: &str = "arete:solana-gateway";
50
51/// Exact scope for chain reads.
52pub const SCOPE_READ: &str = "read";
53
54/// Exact scope for transaction inspection operations.
55pub const SCOPE_TRANSACTION_INSPECT: &str = "transaction:inspect";
56
57/// Exact scope for transaction submission.
58pub const SCOPE_TRANSACTION_SEND: &str = "transaction:send";
59
60/// Exact scope for the read-only fork JSON-RPC endpoint (`POST /rpc/v1/fork`).
61///
62/// Independent from [`SCOPE_READ`]: a fork session may forward a bounded,
63/// allowlisted set of read methods to the gateway's read RPC, and nothing else.
64pub const SCOPE_FORK_READ: &str = "fork:read";
65
66/// Default session token TTL in seconds (5 minutes)
67pub const DEFAULT_SESSION_TTL_SECONDS: u64 = 300;
68
69/// Refresh window in seconds before expiry (60 seconds)
70pub const DEFAULT_REFRESH_WINDOW_SECONDS: u64 = 60;
arete_auth/lib.rs

arete_auth/
lib.rs
