attested_request/lib.rs
1//! Sign and verify World App attested-key canonical requests.
2//!
3//! A World App request is signed with a device key that the Attestation Gateway attested. The
4//! gateway's JWT (`Integrity-Token`) carries that key as `cnf.jwk`; the app signs an RFC 9421
5//! signature base covering the method, scheme, authority, path, query, body digest and the token
6//! itself. A verifier rebuilds the same base from the request it received and checks the
7//! signature with the attested key.
8//!
9//! This crate implements the TFH RFC 9421 integrity request signing profile. It has no
10//! transport: [`verify::Verifier`] takes a request head and body, and [`sign`] produces the
11//! headers for a request. `attested-request-tower` adapts it to tower and axum.
12//!
13//! Verification proves that an attested app on an attested device signed this exact request. It
14//! does not identify a user or authorize access to anything.
15
16pub mod base;
17pub mod device;
18pub mod profile;
19pub mod reject;
20#[cfg(feature = "remote-jwks")]
21pub mod remote_jwks;
22pub mod replay;
23pub mod sign;
24pub mod signature;
25#[cfg(feature = "test-util")]
26pub mod test_util;
27pub mod token;
28pub mod verify;
29
30pub use crate::{
31 profile::{Component, Platform},
32 reject::{RejectReason, Rejection},
33 verify::{VerifiedAttestedKeyContext, Verifier},
34};