Skip to main content

cheers_server/
lib.rs

1//! # cheers-server — the origin-side surface
2//!
3//! The mint half of edge-verifiable auth (R019): everything that can *create or
4//! destroy* a session, plus the origin-homed stores. Holding any of this is
5//! origin-only power, which is why it lives below `cheers-verify` in the DAG and
6//! never leaks to the edge.
7//!
8//! - [`codec`] — the concrete token codecs. The symmetric [`PasetoV4Codec`]
9//!   (v4.local, encrypted) and [`HmacBlobCodec`] (HMAC-SHA256) impl *both*
10//!   [`TokenMinter`](cheers_core::TokenMinter) and
11//!   [`TokenVerifier`](cheers_core::TokenVerifier) on one type, so they MUST live
12//!   here — putting them in `cheers-verify` would re-grant mint to the edge. The
13//!   asymmetric [`PasetoV4SecretMinter`] (Ed25519 secret key) mints only; its
14//!   matching public verifier lives in `cheers-verify`.
15//! - [`store`] — the origin stores [`UserStore`] and [`RefreshStore`]
16//!   (`CredentialStore`, the device store, stays in `cheers-core`).
17//! - [`refresh`] — refresh-token rotation with replay detection.
18//! - [`revocation`] — [`RevocationWriter`], the cold-path write side (the edge
19//!   holds `cheers_verify::RevocationReader`).
20//! - [`session`] — the [`SessionAuthority`] facade that assembles the above.
21//!
22//! This crate depends on `cheers-verify` (and through it `cheers-core`); the
23//! reverse never holds, which is what keeps the edge minter-free.
24
25pub mod audit;
26pub mod bundles;
27pub mod camp;
28pub mod codec;
29pub mod grants;
30pub mod mcp_authority;
31pub mod ownership;
32pub mod refresh;
33pub mod revocation;
34pub mod service_principal;
35pub mod session;
36pub mod store;
37pub mod user_tokens;
38
39pub use audit::{
40    AuditCursor, AuditCursorError, AuditPage, AuditQuery, AuditQueryError, AuditRecord, AuditRow,
41    AuditStore, AuditValidationError, DEFAULT_AUDIT_PAGE_LIMIT, MAX_AUDIT_PAGE_LIMIT,
42    MemoryAuditStore,
43};
44pub use bundles::{
45    BundleExpansionError, BundleName, BundleStore, MemoryBundleStore, ScopeOrBundle,
46    expand_scopes,
47};
48pub use camp::{
49    CampAuthority, CampAuthorityError, CampBootstrapCredential, CampBootstrapPolicy,
50    CampPrincipalStore, MemoryCampPrincipalStore, MemoryUserSigningKeyStore, NewCampPrincipal,
51    ProvisionedCamp, UserSigningKey, UserSigningKeyStatus, UserSigningKeyStore,
52};
53pub use codec::{HmacBlobCodec, PasetoV4Codec, PasetoV4SecretMinter};
54pub use grants::{GrantStore, MemoryGrantStore};
55pub use mcp_authority::{McpAuthority, McpMintError, McpPolicy, MintedMcpToken};
56pub use ownership::{NewOwnership, OwnershipRow, OwnershipStore, OwnershipValidationError};
57pub use refresh::{ChainId, RefreshRotator, RefreshToken, Rotated};
58pub use revocation::RevocationWriter;
59pub use service_principal::{
60    MemoryServicePrincipalStore, NewServicePrincipal, OverlapPolicy, ProvisionedKey,
61    ServicePrincipalAuthority, ServicePrincipalError, ServicePrincipalStore, SigningKey,
62    SigningKeyStatus,
63};
64pub use session::{NewSession, SessionAuthority, SessionPolicy};
65pub use user_tokens::{
66    decode_scopes, encode_scopes, MemoryUserTokenStore, UserTokenRecord, UserTokenStore,
67};
68pub use store::{
69    NewUser, PasskeyCredentialStore, ProviderKey, RefreshStore, RefreshTokenRecord, UserStore,
70};
71
72// Re-exported for convenience so an origin consumer can assemble the verify-side
73// pieces (the public verifier + the EdgeVerifier facade) from one crate.
74pub use cheers_verify::{EdgeVerifier, PasetoV4PublicVerifier, RevocationReader};