Skip to main content

cheers_server/
lib.rs

1//! # cheers-server — the origin-side surface
2//!
3//! The mint half of edge-verifiable auth (R019): everything that can *create or
4//! destroy* a session, plus the origin-homed stores. Holding any of this is
5//! origin-only power, which is why it lives below `cheers-verify` in the DAG and
6//! never leaks to the edge.
7//!
8//! - [`codec`] — the concrete token codecs. The symmetric [`PasetoV4Codec`]
9//!   (v4.local, encrypted) and [`HmacBlobCodec`] (HMAC-SHA256) impl *both*
10//!   [`TokenMinter`](cheers_core::TokenMinter) and
11//!   [`TokenVerifier`](cheers_core::TokenVerifier) on one type, so they MUST live
12//!   here — putting them in `cheers-verify` would re-grant mint to the edge. The
13//!   asymmetric [`PasetoV4SecretMinter`] (Ed25519 secret key) mints only; its
14//!   matching public verifier lives in `cheers-verify`.
15//! - [`store`] — the origin stores [`UserStore`] and [`RefreshStore`]
16//!   (`CredentialStore`, the device store, stays in `cheers-core`).
17//! - [`refresh`] — refresh-token rotation with replay detection.
18//! - [`revocation`] — [`RevocationWriter`], the cold-path write side (the edge
19//!   holds `cheers_verify::RevocationReader`).
20//! - [`standing`] — the [`StandingBinder`] that mints standing node bindings
21//!   for LanPair sessions, and its per-device [`BindingSequenceStore`].
22//! - [`session`] — the [`SessionAuthority`] facade that assembles the above.
23//!
24//! This crate depends on `cheers-verify` (and through it `cheers-core`); the
25//! reverse never holds, which is what keeps the edge minter-free.
26
27pub mod audit;
28pub mod bundles;
29pub mod camp;
30pub mod codec;
31pub mod grants;
32pub mod knock;
33pub mod mcp_authority;
34pub mod ownership;
35pub mod refresh;
36pub mod revocation;
37pub mod service_principal;
38pub mod session;
39pub mod snapshot;
40pub mod standing;
41pub mod store;
42pub mod user_tokens;
43
44pub use audit::{
45    AuditCursor, AuditCursorError, AuditPage, AuditQuery, AuditQueryError, AuditRecord, AuditRow,
46    AuditStore, AuditValidationError, DEFAULT_AUDIT_PAGE_LIMIT, MAX_AUDIT_PAGE_LIMIT,
47    MemoryAuditStore,
48};
49pub use bundles::{
50    BundleExpansionError, BundleName, BundleStore, MemoryBundleStore, ScopeOrBundle,
51    expand_scopes,
52};
53pub use camp::{
54    CampAuthority, CampAuthorityError, CampBootstrapCredential, CampBootstrapPolicy,
55    CampPrincipalStore, MemoryCampPrincipalStore, MemoryUserSigningKeyStore, NewCampPrincipal,
56    ProvisionedCamp, UserSigningKey, UserSigningKeyStatus, UserSigningKeyStore,
57};
58pub use codec::{HmacBlobCodec, PasetoV4Codec, PasetoV4SecretMinter};
59pub use grants::{GrantStore, SchemaGrantStore};
60pub use knock::{
61    Admission, Admitted, KnockAuthority, KnockConfig, KnockFlowError, KnockStore, MemoryKnockStore, PendingKnock, Queued,
62    Reconciled, Redeemed, StoredOffer,
63};
64pub use mcp_authority::{McpAuthority, McpMintError, McpPolicy, MintedMcpToken};
65pub use ownership::{
66    new_revocation_key, next_ownership_version, Inserted, MemoryOwnershipStore, NewOwnership, OwnershipRow, OwnershipStore,
67    OwnershipTuples, OwnershipValidationError, SeedTuple, TupleLease, seed_ownership,
68};
69pub use refresh::{ChainId, LiveRefresh, RefreshRotator, RefreshToken, Rotated};
70pub use revocation::{
71    epoch_from_sql, next_epoch, revoked_columns, revoked_from_columns, MemoryRevocationStore, RevokedColumns,
72    RevocationPublisher, RevocationSnapshot, RevocationWriter, SignedRevocationSet,
73};
74pub use service_principal::{
75    MemoryServicePrincipalStore, NewServicePrincipal, OverlapPolicy, ProvisionedKey,
76    ServicePrincipalAuthority, ServicePrincipalError, ServicePrincipalStore, SigningKey,
77    SigningKeyStatus,
78};
79pub use session::{BindingResolver, NewSession, SessionAuthority, SessionPolicy};
80pub use snapshot::{revoke_ownership, revoke_principal_ownership, SignedSetSnapshot, SnapshotIssuer};
81pub use standing::{
82    next_binding_seq, BindingSequenceStore, MemoryBindingSequenceStore, SignedStandingBinding,
83    StandingBinder,
84};
85pub use user_tokens::{
86    decode_scopes, encode_scopes, MemoryUserTokenStore, UserTokenRecord, UserTokenStore,
87};
88pub use store::{
89    NewUser, PasskeyCredentialStore, ProviderKey, RefreshStore, RefreshTokenRecord, UserStore,
90};
91
92// Re-exported for convenience so an origin consumer can assemble the verify-side
93// pieces (the public verifier + the EdgeVerifier facade) from one crate.
94pub use cheers_verify::{
95    EdgeVerifier, IssuerTrust, PasetoV4PublicVerifier, ReplicatedRevocations, RevocationReader,
96    SnapshotVerifier, StandingVerifier,
97};