cheers_server/lib.rs
1//! # cheers-server — the origin-side surface
2//!
3//! The mint half of edge-verifiable auth (R019): everything that can *create or
4//! destroy* a session, plus the origin-homed stores. Holding any of this is
5//! origin-only power, which is why it lives below `cheers-verify` in the DAG and
6//! never leaks to the edge.
7//!
8//! - [`codec`] — the concrete token codecs. The symmetric [`PasetoV4Codec`]
9//! (v4.local, encrypted) and [`HmacBlobCodec`] (HMAC-SHA256) impl *both*
10//! [`TokenMinter`](cheers_core::TokenMinter) and
11//! [`TokenVerifier`](cheers_core::TokenVerifier) on one type, so they MUST live
12//! here — putting them in `cheers-verify` would re-grant mint to the edge. The
13//! asymmetric [`PasetoV4SecretMinter`] (Ed25519 secret key) mints only; its
14//! matching public verifier lives in `cheers-verify`.
15//! - [`store`] — the origin stores [`UserStore`] and [`RefreshStore`]
16//! (`CredentialStore`, the device store, stays in `cheers-core`).
17//! - [`refresh`] — refresh-token rotation with replay detection.
18//! - [`revocation`] — [`RevocationWriter`], the cold-path write side (the edge
19//! holds `cheers_verify::RevocationReader`).
20//! - [`session`] — the [`SessionAuthority`] facade that assembles the above.
21//!
22//! This crate depends on `cheers-verify` (and through it `cheers-core`); the
23//! reverse never holds, which is what keeps the edge minter-free.
24
25pub mod audit;
26pub mod bundles;
27pub mod camp;
28pub mod codec;
29pub mod grants;
30pub mod mcp_authority;
31pub mod ownership;
32pub mod refresh;
33pub mod revocation;
34pub mod service_principal;
35pub mod session;
36pub mod store;
37
38pub use audit::{AuditRecord, AuditRow, AuditStore, AuditValidationError, MemoryAuditStore};
39pub use bundles::{
40 BundleExpansionError, BundleName, BundleStore, MemoryBundleStore, ScopeOrBundle,
41 expand_scopes,
42};
43pub use camp::{
44 CampAuthority, CampAuthorityError, CampBootstrapCredential, CampBootstrapPolicy,
45 CampPrincipalStore, MemoryCampPrincipalStore, MemoryUserSigningKeyStore, NewCampPrincipal,
46 ProvisionedCamp, UserSigningKey, UserSigningKeyStatus, UserSigningKeyStore,
47};
48pub use codec::{HmacBlobCodec, PasetoV4Codec, PasetoV4SecretMinter};
49pub use grants::{GrantStore, MemoryGrantStore};
50pub use mcp_authority::{McpAuthority, McpMintError, McpPolicy, MintedMcpToken};
51pub use ownership::{NewOwnership, OwnershipRow, OwnershipStore, OwnershipValidationError};
52pub use refresh::{ChainId, RefreshRotator, RefreshToken, Rotated};
53pub use revocation::RevocationWriter;
54pub use service_principal::{
55 MemoryServicePrincipalStore, NewServicePrincipal, OverlapPolicy, ProvisionedKey,
56 ServicePrincipalAuthority, ServicePrincipalError, ServicePrincipalStore, SigningKey,
57 SigningKeyStatus,
58};
59pub use session::{NewSession, SessionAuthority, SessionPolicy};
60pub use store::{
61 NewUser, PasskeyCredentialStore, ProviderKey, RefreshStore, RefreshTokenRecord, UserStore,
62};
63
64// Re-exported for convenience so an origin consumer can assemble the verify-side
65// pieces (the public verifier + the EdgeVerifier facade) from one crate.
66pub use cheers_verify::{EdgeVerifier, PasetoV4PublicVerifier, RevocationReader};