chronix_security/lib.rs
1#![deny(unsafe_code)]
2//! # Chronix Security
3//!
4//! The consolidated security layer for Chronix:
5//!
6//! - [`auth`] — authentication: API keys (Argon2), JWT/OIDC (JWKS discovery,
7//! `jti` replay protection), mTLS client certificates, encryption at rest
8//! (AES-256-GCM with pluggable key providers and automated rotation).
9//! - [`authz`] — authorization: Cedar-based RBAC + ABAC with default-deny
10//! semantics, policy hot-reload, schema validation, and row-level policies.
11//! - [`audit`] — tamper-evident audit trail: HMAC-SHA256 hash-chained records
12//! with pluggable sinks (memory, file, tracing, webhook).
13//! - [`tenant`] — multi-tenancy: namespace registry and per-tenant quota
14//! enforcement.
15//!
16//! All submodules are independent; embedded deployments that need none of
17//! this simply never construct the types.
18
19pub mod audit;
20pub mod auth;
21pub mod authz;
22pub mod tenant;