cheers_verify/
edge.rs

1//! The [`EdgeVerifier`] facade — what a CF Worker holds.
2
3use cheers_core::{Claims, Error, PeerKey, TokenVerifier};
4
5use crate::revocation::RevocationReader;
6
7/// Edge facade: verify a token, then check it hasn't been revoked.
8///
9/// Holds a [`TokenVerifier`] and a [`RevocationReader`] — and nothing else.
10/// There is **no `TokenMinter` in this type**, so an edge built on it cannot
11/// forge sessions even if compromised; that absence is the whole point of the
12/// asymmetric codec split. Generic (not `dyn`) so the "no minter" property is a
13/// fact about the type, not a runtime convention. Pair a
14/// [`PasetoV4PublicVerifier`](crate::PasetoV4PublicVerifier) with a CF-KV-backed
15/// `RevocationReader`.
16pub struct EdgeVerifier<V, Rd> {
17    verifier: V,
18    revoked: Rd,
19}
20
21impl<V, Rd> EdgeVerifier<V, Rd>
22where
23    V: TokenVerifier + Send + Sync,
24    Rd: RevocationReader,
25{
26    pub fn new(verifier: V, revoked: Rd) -> Self {
27        Self { verifier, revoked }
28    }
29
30    /// Verify `token` against `now`, then reject it if its `jti` is revoked.
31    ///
32    /// Two stages, cheapest first: cryptographic verification (stateless, local
33    /// to the edge) gates the revocation read, so a forged or expired token
34    /// never reaches the revocation set. A token that verifies but whose `jti`
35    /// is revoked returns [`Error::Revoked`].
36    pub async fn verify_at(&self, token: &str, now: i64) -> Result<Claims, Error> {
37        let claims = self.verifier.verify_at(token, now)?;
38        if self.revoked.is_revoked(&claims.jti).await? {
39            return Err(Error::Revoked);
40        }
41        Ok(claims)
42    }
43
44    /// [`verify_at`](Self::verify_at), plus: the token must be bound to
45    /// `presented` — the long-lived public key the *connecting peer* already
46    /// proved possession of in the transport handshake (R515).
47    ///
48    /// This is what turns a bearer token into a proof that **token holder ==
49    /// connecting peer**. Without it a stolen token replays under the thief's
50    /// own node key and they become the victim user; with it the stolen token
51    /// names a key the thief cannot present, and this returns
52    /// [`Error::PeerKeyMismatch`].
53    ///
54    /// Three stages, cheapest and most local first: signature (stateless),
55    /// binding (a byte compare, still local), then the revocation read (the
56    /// only I/O). An **unbound** token is rejected here too — it asserts
57    /// nothing about any node key, so it cannot satisfy a binding check. A
58    /// deployment that also admits unbound tokens must call
59    /// [`verify_at`](Self::verify_at) and branch on
60    /// [`Claims::peer_key`](cheers_core::Claims::peer_key) itself, so that
61    /// choice is visible at the call site.
62    ///
63    /// The caller supplies `presented` from its own transport — cheers has no
64    /// view of the connection and never infers the peer key from the token.
65    pub async fn verify_bound_at(
66        &self,
67        token: &str,
68        presented: &PeerKey,
69        now: i64,
70    ) -> Result<Claims, Error> {
71        let claims = self.verifier.verify_at(token, now)?;
72        if !claims.is_bound_to(presented) {
73            return Err(Error::PeerKeyMismatch);
74        }
75        if self.revoked.is_revoked(&claims.jti).await? {
76            return Err(Error::Revoked);
77        }
78        Ok(claims)
79    }
80}
cheers_verify/edge.rs

cheers_verify/
edge.rs
