chio_tower/lib.rs
1//! Tower middleware for Chio capability validation and receipt signing.
2//!
3//! Provides a `tower::Layer` that wraps any HTTP service with Chio evaluation:
4//! extracting caller identity, evaluating requests against the Chio kernel,
5//! and attaching signed receipts to responses.
6//!
7//! Works with replayable Tower request body types, including Axum's
8//! `axum::body::Body` and bytes-backed HTTP bodies used in generic Tower/HTTP2
9//! tests. Real `tonic::body::Body` replay remains a follow-on concern and is
10//! not claimed as fully covered by the current middleware contract.
11//!
12//! # Example with Tower service
13//!
14//! ```rust
15//! use chio_tower::ChioLayer;
16//! use chio_core_types::crypto::Keypair;
17//! use tower::Layer;
18//!
19//! let keypair = Keypair::generate();
20//! let layer = ChioLayer::new(keypair, "policy-hash-abc".to_string());
21//!
22//! // Wrap any tower Service with Chio evaluation.
23//! let inner = tower::service_fn(|_req: http::Request<http_body_util::Full<bytes::Bytes>>| async {
24//! Ok::<_, Box<dyn std::error::Error + Send + Sync>>(http::Response::new(()))
25//! });
26//! let _service = layer.layer(inner);
27//! ```
28
29#![forbid(unsafe_code)]
30
31mod error;
32mod evaluator;
33mod host_call;
34mod identity;
35mod kernel_service;
36mod layer;
37mod metrics;
38mod request_metadata;
39mod service;
40
41pub use error::ChioTowerError;
42pub use evaluator::{ChioEvaluator, EvaluationResult};
43pub use host_call::{
44 normalize_host_call_metric_label, HOST_CALL_FETCH_BLOB, HOST_CALL_GET_CONFIG,
45 HOST_CALL_GET_TIME_UNIX_SECS, HOST_CALL_LOG, HOST_CALL_METRIC_LABEL_VALUES,
46};
47pub use identity::{extract_identity, IdentityExtractor};
48pub use kernel_service::{
49 build_layered, KernelRequest, KernelResponse, KernelService, KernelServiceError,
50 KernelTraceLayer, KernelTraceService, TenantConcurrencyLimitLayer,
51 TenantConcurrencyLimitService, TenantId,
52};
53pub use layer::ChioLayer;
54pub use service::{ChioService, DEFAULT_MAX_BODY_BYTES};