Module camp 

Camp-principal bootstrap — provision a camp on behalf of a user U.

See .yah/docs/working/mcp-auth-and-ownership.md §Camp bootstrap. This module is the origin-side implementation of the doc’s mint flow #2 provisioning step:

1. Yubaba (authenticated as its service principal) calls POST /admin/camps/bootstrap with a NewCampPrincipal + a UserDelegation (a payload signed by user U via the yah-side W122 flow). The HTTP layer lives in cheers-axum.
2. CampAuthority::provision verifies the delegation’s Ed25519 signature against a key trusted for U (per UserSigningKeyStore), allocates a Principal of kind = Camp with bound_to = Some(user:U), persists the delegation as the auditable “U authorised camp C” record, and issues a CampBootstrapCredential that the camp later exchanges for a short-TTL access token via McpAuthority::mint_bootstrap.
3. Cascading revocation: CampAuthority::revoke_user_cascade flips every camp principal bound_to: U to Revoked in one sweep. Revoking U revokes every camp bound to U; revoking the camp alone does NOT touch U.

The crate-direction invariant from R019 still holds: this module is origin-only (it verifies a signed delegation and persists a credential). cheers-verify consumers (kamaji, CF Worker) never depend on this crate — they verify the MCP-call tokens minted via path #2, not the bootstrap credential itself.

Structs

CampAuthority

Origin-side facade for camp-principal provisioning + cascade revocation.

CampBootstrapCredential

One row in the camp-bootstrap-credential table.

CampBootstrapPolicy

TTL defaults for a bootstrap credential.

MemoryCampPrincipalStore

MemoryUserSigningKeyStore

In-memory UserSigningKeyStore for tests and single-node bootstrapping. Cheap to clone — shares one backing map.

NewCampPrincipal

Provision input — what callers hand to CampAuthority::provision.

ProvisionedCamp

The output of a successful CampAuthority::provision call — the camp principal record and the long-lived bootstrap credential the caller hands to yubaba.

UserSigningKey

One Ed25519 pubkey trusted for delegations signed by a user.

Enums

CampAuthorityError

Typed failure modes for CampAuthority operations.

UserSigningKeyStatus

Lifecycle state of a user’s signing key — mirrors SigningKeyStatus on the service-principal side. Only Active keys are accepted for delegation verification.

Traits

CampPrincipalStore

Persistence for the camp-principal surface — principal records, bootstrap credentials, and the retained delegation audit trail.

UserSigningKeyStore

Persistence for UserSigningKey records.