spacedb_access/lib.rs
1#![forbid(unsafe_code)]
2//! # spacedb-access — SpaceDB Layer 5 (identity & access)
3//!
4//! The consent layer, and the AI-age differentiator: **inaccessible by default,
5//! accessible by mID-gated consent**. Every read / write / compute is authorized
6//! by a signed, scoped, expiring, (S2) revocable [`Capability`] issued by an
7//! owner's identity to a bearer — a human or an AI agent with its *own* identity.
8//!
9//! M5-S1 ships the core: [`Identity`] (ECDSA P-256 / ES256), the [`Capability`] +
10//! [`SignedCapability`] model, the [`KeyDirectory`] seam (DID → published key),
11//! and [`authorize`] — the single chokepoint enforcing signature · bearer · scope
12//! · ops · expiry. Revocation + delegation (S2) and the audit log + human-vs-AI
13//! policy (S3) build on this.
14//!
15//! Open-core (MIT): no MATA dependency. Identities are P-256 keys behind the
16//! `KeyDirectory` seam; MATA resolves `did:mata` via IAMHUMAN, a self-hoster uses
17//! [`MemKeyDirectory`]. ES256 matches mID, so MATA's real mIDs verify identically.
18
19mod error;
20pub use error::{AccessError, AccessResult};
21
22mod identity;
23pub use identity::{Did, Identity};
24
25mod directory;
26pub use directory::{KeyDirectory, MemKeyDirectory};
27
28mod capability;
29pub use capability::{Capability, Ops, Scope, SignedCapability};
30
31mod revocation;
32pub use revocation::RevocationSet;
33
34mod chain;
35pub use chain::{delegate, CapabilityChain};
36
37mod authorize;
38pub use authorize::{
39 authorize, authorize_chain, AccessRequest, Decision, DelegationError, DenyReason,
40};
41
42mod policy;
43pub use policy::{gate, AccessPolicy};
44
45mod audit;
46pub use audit::{AuditDecision, AuditEntry, AuditError, AuditLog, AuditResult};
47
48/// Compiles the README's examples as doctests, so the documented API can never
49/// drift from the real one. Not part of the public API, and not rendered into
50/// the crate docs — it exists only under `cargo test --doc`.
51#[cfg(doctest)]
52#[doc = include_str!("../README.md")]
53pub struct ReadmeDoctests;