arete_auth/
lib.rs

1//! Arete Authentication Library
2//!
3//! This crate provides authentication and authorization utilities for Arete,
4//! including JWT token handling, claims validation, and key management.
5
6pub mod audit;
7pub mod claims;
8pub mod error;
9pub mod keys;
10pub mod metrics;
11pub mod multi_key;
12pub mod program_read;
13pub mod revocation;
14pub mod solana_gateway;
15pub mod token;
16pub mod verifier;
17
18pub use audit::{
19    auth_failure_event, auth_success_event, rate_limit_event, AuditEvent, AuditSeverity,
20    ChannelAuditLogger, NoOpAuditLogger, SecurityAuditEvent, SecurityAuditLogger,
21};
22pub use claims::{
23    AuthContext, KeyClass, Limits, PolicyClaimsError, SessionClaims, TargetKind,
24    MAX_POLICY_IDENTITY_BYTES, PLAN_ANONYMOUS,
25};
26pub use error::{AuthError, AuthErrorCode, RetryPolicy, VerifyError};
27pub use keys::{KeyLoader, SigningKey, VerifyingKey};
28pub use metrics::{AuthMetrics, AuthMetricsCollector, AuthMetricsSnapshot};
29pub use multi_key::{MultiKeyVerifier, MultiKeyVerifierBuilder, RotationKey};
30pub use program_read::{ProgramReadAuthorization, ProgramReadAuthorizationError};
31pub use revocation::{RevocationChecker, TokenRevocationList};
32pub use solana_gateway::{
33    SolanaGatewayAuthorization, SolanaGatewayAuthorizationError, SolanaGatewayScope,
34};
35pub use token::{TokenError, TokenSigner, TokenVerifier};
36pub use verifier::{AsyncVerifier, SimpleVerifier};
37
38/// Stable JWT audience for the shared program-read service.
39pub const PROGRAM_READ_AUDIENCE: &str = "arete:program-read";
40
41/// Stable JWT audience shared by all regional Solana gateways.
42pub const SOLANA_GATEWAY_AUDIENCE: &str = "arete:solana-gateway";
43
44/// Exact scope for chain reads.
45pub const SCOPE_READ: &str = "read";
46
47/// Exact scope for transaction inspection operations.
48pub const SCOPE_TRANSACTION_INSPECT: &str = "transaction:inspect";
49
50/// Exact scope for transaction submission.
51pub const SCOPE_TRANSACTION_SEND: &str = "transaction:send";
52
53/// Default session token TTL in seconds (5 minutes)
54pub const DEFAULT_SESSION_TTL_SECONDS: u64 = 300;
55
56/// Refresh window in seconds before expiry (60 seconds)
57pub const DEFAULT_REFRESH_WINDOW_SECONDS: u64 = 60;
arete_auth/lib.rs

arete_auth/
lib.rs
