Struct SessionAuthority 

pub struct SessionAuthority<M, R, U, W> { /* private fields */ }

Origin facade: everything that can create or destroy sessions.

Holds the four origin-tier capabilities — a TokenMinter, a RefreshStore, a UserStore, and a RevocationWriter — plus a SessionPolicy. Generic (not dyn) so the assembled capability set is visible in the type; a consumer wires concrete impls (e.g. PasetoV4SecretMinter + Yubaba-backed stores).

Implementations

impl<M, R, U, W> SessionAuthority<M, R, U, W>

where M: TokenMinter + Send + Sync, R: RefreshStore, U: UserStore, W: RevocationWriter,

pub fn new(minter: M, refresh: R, users: U, revoke: W) -> Self

Assemble an authority with the default policy.

pub fn with_policy(self, policy: SessionPolicy) -> Self

Override the TTL policy.

pub fn policy(&self) -> &SessionPolicy

pub fn users(&self) -> &U

The held UserStore, for device-management reads (list_devices).

pub async fn establish( &self, sub: UserId, device: DeviceId, binding: DeviceBinding, now: i64, ) -> Result<NewSession, Error>

Establish a fresh session: mint a short-TTL access token (with a fresh jti) and start a homed refresh chain for (sub, device).

pub async fn establish_bound( &self, sub: UserId, device: DeviceId, binding: DeviceBinding, peer_key: PeerKey, now: i64, ) -> Result<NewSession, Error>

Establish a session whose access token is bound to peer_key — the mint half of R515.

Identical to establish except the minted claims carry Claims::peer_key, so a verifier that has already authenticated the connecting peer under that key can prove token holder == connecting peer (see EdgeVerifier::verify_bound_at). A token stolen from this client is then useless to a thief connecting under their own key.

cheers does not establish that the caller possesses peer_key — that proof belongs to the enrollment ceremony in the consuming service (the app proves possession of the key, presents its existing session, and then calls this). cheers’s own HTTP ceremonies can’t do it: a browser passkey or magic-link sign-in has no node key at all.

The refresh chain is unchanged, and deliberately does not record the key: like binding, the peer key is a fact about this access token, not about the chain — so rotate_bound takes it from the caller again.

pub async fn rotate( &self, presented_refresh: &str, binding: DeviceBinding, now: i64, ) -> Result<NewSession, Error>

Rotate presented_refresh → fresh access token + successor refresh token. Replay detection / chain revocation are the rotator’s (see RefreshRotator::rotate). The binding is supplied by the caller because the refresh record doesn’t carry it — guide by omission, the refresh chain is about which session, not how it authenticated.

pub async fn rotate_bound( &self, presented_refresh: &str, binding: DeviceBinding, peer_key: PeerKey, now: i64, ) -> Result<NewSession, Error>

Rotate into a fresh access token that is bound to peer_key (R515).

The peer key is supplied by the caller for the same reason binding is: the refresh record is about which session, not about how this particular access token is being presented. A node re-binds on every rotation, which is what keeps the binding honest if the node key changes.

pub async fn revoke_session(&self, jti: &str) -> Result<(), Error>

Revoke a single access token by its jti — the immediate, edge-visible kill (within the propagation window bounded by the access TTL).

pub async fn revoke_device( &self, user_id: &UserId, device_id: &DeviceId, ) -> Result<(), Error>

Records device-level revocation intent via the UserStore. Blocking new sessions also means revoking that device’s refresh chains via the RefreshStore; killing an in-flight access token is revoke_session. The product owns the device→chain index that drives the first, so this facade exposes the store call and the per-jti kill, not a magic “log out everywhere”.