Crate cheers_server 

cheers-server — the origin-side surface

The mint half of edge-verifiable auth (R019): everything that can create or destroy a session, plus the origin-homed stores. Holding any of this is origin-only power, which is why it lives below cheers-verify in the DAG and never leaks to the edge.

• codec — the concrete token codecs. The symmetric PasetoV4Codec (v4.local, encrypted) and HmacBlobCodec (HMAC-SHA256) impl both TokenMinter and TokenVerifier on one type, so they MUST live here — putting them in cheers-verify would re-grant mint to the edge. The asymmetric PasetoV4SecretMinter (Ed25519 secret key) mints only; its matching public verifier lives in cheers-verify.
• store — the origin stores UserStore and RefreshStore (CredentialStore, the device store, stays in cheers-core).
• refresh — refresh-token rotation with replay detection.
• revocation — RevocationWriter, the cold-path write side (the edge holds cheers_verify::RevocationReader).
• session — the SessionAuthority facade that assembles the above.

This crate depends on cheers-verify (and through it cheers-core); the reverse never holds, which is what keeps the edge minter-free.

Re-exports

pub use audit::AuditCursor;

pub use audit::AuditCursorError;

pub use audit::AuditPage;

pub use audit::AuditQuery;

pub use audit::AuditQueryError;

pub use audit::AuditRecord;

pub use audit::AuditRow;

pub use audit::AuditStore;

pub use audit::AuditValidationError;

pub use audit::DEFAULT_AUDIT_PAGE_LIMIT;

pub use audit::MAX_AUDIT_PAGE_LIMIT;

pub use audit::MemoryAuditStore;

pub use bundles::BundleExpansionError;

pub use bundles::BundleName;

pub use bundles::BundleStore;

pub use bundles::MemoryBundleStore;

pub use bundles::ScopeOrBundle;

pub use bundles::expand_scopes;

pub use camp::CampAuthority;

pub use camp::CampAuthorityError;

pub use camp::CampBootstrapCredential;

pub use camp::CampBootstrapPolicy;

pub use camp::CampPrincipalStore;

pub use camp::MemoryCampPrincipalStore;

pub use camp::MemoryUserSigningKeyStore;

pub use camp::NewCampPrincipal;

pub use camp::ProvisionedCamp;

pub use camp::UserSigningKey;

pub use camp::UserSigningKeyStatus;

pub use camp::UserSigningKeyStore;

pub use codec::HmacBlobCodec;

pub use codec::PasetoV4Codec;

pub use codec::PasetoV4SecretMinter;

pub use grants::GrantStore;

pub use grants::MemoryGrantStore;

pub use mcp_authority::McpAuthority;

pub use mcp_authority::McpMintError;

pub use mcp_authority::McpPolicy;

pub use mcp_authority::MintedMcpToken;

pub use ownership::NewOwnership;

pub use ownership::OwnershipRow;

pub use ownership::OwnershipStore;

pub use ownership::OwnershipValidationError;

pub use refresh::ChainId;

pub use refresh::RefreshRotator;

pub use refresh::RefreshToken;

pub use refresh::Rotated;

pub use revocation::RevocationWriter;

pub use service_principal::MemoryServicePrincipalStore;

pub use service_principal::NewServicePrincipal;

pub use service_principal::OverlapPolicy;

pub use service_principal::ProvisionedKey;

pub use service_principal::ServicePrincipalAuthority;

pub use service_principal::ServicePrincipalError;

pub use service_principal::ServicePrincipalStore;

pub use service_principal::SigningKey;

pub use service_principal::SigningKeyStatus;

pub use session::NewSession;

pub use session::SessionAuthority;

pub use session::SessionPolicy;

pub use store::NewUser;

pub use store::PasskeyCredentialStore;

pub use store::ProviderKey;

pub use store::RefreshStore;

pub use store::RefreshTokenRecord;

pub use store::UserStore;

Modules

audit

Centralized audit table — the AuditStore trait.

bundles

Role-bundle storage and mint-time expansion.

camp

Camp-principal bootstrap — provision a camp on behalf of a user U.

codec

Concrete session-token codecs — origin-side.

grants

Grant persistence — what scope-or-bundle entries a principal holds against a given audience.

mcp_authority

The McpAuthority origin facade for minting MCP-call tokens.

ownership

Embedded-ownership persistence — the OwnershipStore trait.

refresh

Refresh-token rotation with replay detection.

revocation

The write side of the revocation split.

service_principal

Service-principal lifecycle — provisioning, rotation, key publication.

session

The SessionAuthority origin facade + SessionPolicy TTL defaults.

store

Origin-side persistence contracts — UserStore and RefreshStore.

Structs

EdgeVerifier

Edge facade: verify a token, then check it hasn’t been revoked.

PasetoV4PublicVerifier

PASETO v4.public verifier — checks signatures with an Ed25519 public key.

Traits

RevocationReader

Edge-side revocation check. The verify-only consumer depends on this — it can ask whether a jti is revoked but holds no power to revoke.