Skip to main content

cheers_server/
lib.rs

1//! # cheers-server — the origin-side surface
2//!
3//! The mint half of edge-verifiable auth (R019): everything that can *create or
4//! destroy* a session, plus the origin-homed stores. Holding any of this is
5//! origin-only power, which is why it lives below `cheers-verify` in the DAG and
6//! never leaks to the edge.
7//!
8//! - [`codec`] — the concrete token codecs. The symmetric [`PasetoV4Codec`]
9//!   (v4.local, encrypted) and [`HmacBlobCodec`] (HMAC-SHA256) impl *both*
10//!   [`TokenMinter`](cheers_core::TokenMinter) and
11//!   [`TokenVerifier`](cheers_core::TokenVerifier) on one type, so they MUST live
12//!   here — putting them in `cheers-verify` would re-grant mint to the edge. The
13//!   asymmetric [`PasetoV4SecretMinter`] (Ed25519 secret key) mints only; its
14//!   matching public verifier lives in `cheers-verify`.
15//! - [`store`] — the origin stores [`UserStore`] and [`RefreshStore`]
16//!   (`CredentialStore`, the device store, stays in `cheers-core`).
17//! - [`refresh`] — refresh-token rotation with replay detection.
18//! - [`revocation`] — [`RevocationWriter`], the cold-path write side (the edge
19//!   holds `cheers_verify::RevocationReader`).
20//! - [`session`] — the [`SessionAuthority`] facade that assembles the above.
21//!
22//! This crate depends on `cheers-verify` (and through it `cheers-core`); the
23//! reverse never holds, which is what keeps the edge minter-free.
24
25pub mod audit;
26pub mod bundles;
27pub mod camp;
28pub mod codec;
29pub mod grants;
30pub mod mcp_authority;
31pub mod ownership;
32pub mod refresh;
33pub mod revocation;
34pub mod service_principal;
35pub mod session;
36pub mod store;
37
38pub use audit::{
39    AuditCursor, AuditCursorError, AuditPage, AuditQuery, AuditQueryError, AuditRecord, AuditRow,
40    AuditStore, AuditValidationError, DEFAULT_AUDIT_PAGE_LIMIT, MAX_AUDIT_PAGE_LIMIT,
41    MemoryAuditStore,
42};
43pub use bundles::{
44    BundleExpansionError, BundleName, BundleStore, MemoryBundleStore, ScopeOrBundle,
45    expand_scopes,
46};
47pub use camp::{
48    CampAuthority, CampAuthorityError, CampBootstrapCredential, CampBootstrapPolicy,
49    CampPrincipalStore, MemoryCampPrincipalStore, MemoryUserSigningKeyStore, NewCampPrincipal,
50    ProvisionedCamp, UserSigningKey, UserSigningKeyStatus, UserSigningKeyStore,
51};
52pub use codec::{HmacBlobCodec, PasetoV4Codec, PasetoV4SecretMinter};
53pub use grants::{GrantStore, MemoryGrantStore};
54pub use mcp_authority::{McpAuthority, McpMintError, McpPolicy, MintedMcpToken};
55pub use ownership::{NewOwnership, OwnershipRow, OwnershipStore, OwnershipValidationError};
56pub use refresh::{ChainId, RefreshRotator, RefreshToken, Rotated};
57pub use revocation::RevocationWriter;
58pub use service_principal::{
59    MemoryServicePrincipalStore, NewServicePrincipal, OverlapPolicy, ProvisionedKey,
60    ServicePrincipalAuthority, ServicePrincipalError, ServicePrincipalStore, SigningKey,
61    SigningKeyStatus,
62};
63pub use session::{NewSession, SessionAuthority, SessionPolicy};
64pub use store::{
65    NewUser, PasskeyCredentialStore, ProviderKey, RefreshStore, RefreshTokenRecord, UserStore,
66};
67
68// Re-exported for convenience so an origin consumer can assemble the verify-side
69// pieces (the public verifier + the EdgeVerifier facade) from one crate.
70pub use cheers_verify::{EdgeVerifier, PasetoV4PublicVerifier, RevocationReader};