Crate chisel_auth 

Chisel platform authentication: JWT sessions with a closed role vocabulary, and the OIDC desktop-loopback seam over the kit estate.

Two kit surfaces composed here, both kept behind thin Chisel vocabulary:

• tokenkit — JWT issue/validate with rotation-capable configuration (SessionService).
• oauth_toolkit — the OIDC desktop-loopback flow with PKCE and CSRF state ([LoginFlow]).

The v0.1 rule: everything here is testable offline. The one network step in OIDC (the authorization-code exchange at the provider’s token endpoint) is behind the TokenExchanger trait — the HTTP implementation arrives with the service slice, and tests inject a stub.

Modules

passkey

Passkey (WebAuthn) ceremonies over webauthn-kit.

Structs

ChiselClaims

The claims carried by a Chisel session token: tokenkit’s standard claims (whose role field carries the session’s role name) plus the session id.

LoginStart

The outcome of starting a desktop login: open url in a browser, then wait() for the loopback capture.

OidcProviderConfig

The OIDC provider facts the desktop login needs. The app supplies them (from its settings or the provider’s discovery document).

SessionService

Issues and validates Chisel session tokens over tokenkit’s JWT service with rotation-capable secrets.

SessionTokens

The token pair handed out at login and refresh.

Enums

Capability

The closed capability set. A capability is a verb-like permission the UI and the service both check before acting.

Error

Authentication failures.

Role

The closed role vocabulary for the platform, declared weakest-first so the derived ordering matches strength (Auditor < Reviewer < Editor < Owner); capabilities accumulate upward.

Traits

TokenExchanger

Exchanges an authorization code for OIDC tokens at the provider’s token endpoint. The HTTP implementation belongs to the service slice; tests inject closures.

Functions

start_login

Starts a desktop OIDC login against provider: builds the PKCE pair and CSRF state via the kit, binds the loopback listener, and returns the URL to open. Complete the flow by waiting and exchanging the code.

Type Aliases

Result

Convenient alias for auth operations.