cheers_verify/lib.rs
1//! # cheers-verify — the edge-safe, verify-only surface
2//!
3//! The verify half of edge-verifiable auth (R019). Everything here can *check* a
4//! session but cannot *create* one:
5//!
6//! - [`PasetoV4PublicVerifier`] — PASETO v4.public (Ed25519) verification with a
7//! public key alone. The only [`TokenVerifier`](cheers_core::TokenVerifier) that
8//! cannot also mint (the symmetric codecs in `cheers-server` impl both halves).
9//! - [`RevocationReader`] — the read side of the revocation split: point
10//! checks (jti, device, membership) against an eventually-consistent replica
11//! (CF KV / gossip). [`ReplicatedRevocations`] is the offline replica: it
12//! adopts issuer-signed revocation sets by epoch (R732-F6).
13//! - [`IssuerTrust`] — "was this artifact signed by the issuer I trust?",
14//! against a pinned key or a JWKS key set; exportable as a [`TrustDoc`] so
15//! an offline edge restarts against the keys it persisted.
16//! - [`StandingVerifier`] — admits a standing node binding (R732-F5): no
17//! expiry, bound to the peer's node key, ended only by revocation or by a
18//! newer binding for the same device ([`BindingLedger`]).
19//! - [`EdgeVerifier`] — the facade a CF Worker holds: verify a token, then check
20//! it hasn't been revoked. It takes a `TokenVerifier`, so there is *no code
21//! path to mint* — that absence is what makes shipping it to the edge safe.
22//!
23//! - [`KeySetVerifier`] — verification against a JWKS key set with key-role
24//! enforcement (§D5), fed by a static [`KeySet`] or the W159 [`JwksCache`]
25//! (fetching over HTTP behind the `jwks-http` feature).
26//!
27//! This crate depends on `cheers-core` and `pasetors`, but on **no minter**.
28//! `cheers-server` depends on this crate, never the reverse — that single
29//! direction is what guarantees a verify-only consumer has no minter in its
30//! dependency graph.
31
32pub mod admit;
33pub mod artifact;
34pub mod edge;
35pub mod jwks;
36pub mod key_set;
37pub mod public_verifier;
38pub mod revocation;
39pub mod snapshot;
40pub mod standing;
41
42pub use edge::EdgeVerifier;
43pub use jwks::{JwkKey, JwksCache, JwksCacheConfig, JwksDoc, JwksError, JwksSource, KeyEntry, KeySet};
44#[cfg(feature = "jwks-http")]
45pub use jwks::HttpJwksSource;
46pub use key_set::{KeySetVerifier, VerifyError};
47pub use public_verifier::{codec_err, kid_for, PasetoV4PublicVerifier};
48pub use admit::{artifact_hash, verify_admit_with, verify_device_artifact, AdmitAuthority, AdmitError, Approval, IssuerAdmitAuthority, VerifiedAdmit};
49pub use artifact::{AnchorDoc, IssuerTrust, TrustDoc};
50pub use revocation::{membership_tag, revocation_entry, test_revocation_key, AdoptError, Adopted, ReplicatedRevocations, RevocationReader};
51pub use snapshot::{SnapshotError, SnapshotLedger, SnapshotLedgerDoc, SnapshotVerifier, VerifiedSnapshot};
52pub use standing::{BindingLedger, ForeignLedger, LedgerDoc, StandingError, StandingVerifier, VerifiedStanding};