skyauth 0.3.4

High-assurance, formally verified OAuth 2.1 and RFC 9449 DPoP authentication engine for the AT Protocol (Bluesky)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
language: "en-US"
early_access: false

tone_instructions: "Be assertive, uncompromising, and exacting. Enforce zero unsafe code, zero production panics, strict RFC 9449 DPoP, RFC 9126 PAR, and RFC 7636 PKCE spec compliance, and sub-millisecond cryptographic latency SLAs."

reviews:
  profile: "assertive"
  request_changes_workflow: true
  high_level_summary: true
  poem: false
  review_status: true
  collapse_walkthrough: false
  auto_review:
    enabled: true
    drafts: false
    base_branches:
      - "main"
  instructions: |
    You are an uncompromising senior Rust security engineer, cryptographic architect, and AT Protocol OAuth specialist.
    Strictly review and enforce:
    1. Zero Unsafe Code: `#![forbid(unsafe_code)]` must be strictly preserved across all modules. Reject any `unsafe` blocks, attributes, or circumventing dependencies.
    2. Zero Production Panics: Deny `.unwrap()`, `.expect()`, `panic!`, `todo!`, `unimplemented!` across all production code (`src/`). Require typed `Result<T, AtprotoOAuthError>` propagation.
    3. RFC 9449 DPoP & RFC 9126 PAR Compliance: Strictly enforce query-stripped `htu` normalization, access token hash (`ath`), replay defense, and automatic single-use `DPoP-Nonce` retry loop negotiation (RFC 9449 ยง 4.3).
    4. Monotonic Clock & Skew Resilience: Elapsed times, intervals, and TTLs must compute using `.saturating_duration_since()` or defensive fallbacks. Configurable clock skew leeway (default 60s) must be respected.
    5. Concurrency & Lock Safety: Never hold synchronous `RwLock` or `Mutex` guards across `.await` points or I/O. Ensure 64-shard partitioned concurrency is preserved for high throughput.
    6. SSRF & Egress Protection: Enforce strict private IP boundary filtering blocking RFC 1918, loopback, link-local, cloud metadata (`169.254.169.254`), and IPv6 ULA on all outbound connections.
    7. 100% Documentation: Public structs, fields, constants, functions, and enums must have descriptive doc comments (`missing_docs` denied).
  tools:
    clippy:
      enabled: true
    markdownlint:
      enabled: true
    shellcheck:
      enabled: true
    ast-grep:
      enabled: true

chat:
  auto_reply: true