zerodds_bridge_security/
lib.rs

1// SPDX-License-Identifier: Apache-2.0
2// Copyright 2026 ZeroDDS Contributors
3
4//! Crate `zerodds-bridge-security`. Safety classification: **STANDARD**.
5//!
6//! Gemeinsamer Security-Layer für ZeroDDS Bridge-Daemons (ws / mqtt /
7//! coap / amqp / grpc / corba).
8//!
9//! Spec: ZeroDDS Bridge-Spec 1.0 §7.1 (TLS), §7.2 (Auth-Modes), §7.3
10//! (Topic-ACL).
11//!
12//! ## Schichten-Position
13//!
14//! Layer 5 (Bridges) — Substrat-Crate fuer alle sechs Bridge-Daemons.
15//!
16//! ## Public API (Stand 1.0.0-rc.1)
17//!
18//! - [`Acl`], [`AclEntry`], [`AclOp`] — Topic-ACL mit Wildcard- und
19//!   Group-Matching (§7.3).
20//! - [`AuthMode`], [`AuthSubject`], [`AuthError`] — Auth-Modes
21//!   `none|bearer|jwt|mtls|sasl` (§7.2).
22//! - [`RotatingTlsConfig`], [`build_client_tls_connector`],
23//!   [`parse_server_name`], [`serve_tls_handshake`] — pro-Connection-
24//!   TLS-Helpers (§7.1).
25//! - [`SecurityConfig`], [`SecurityCtx`], [`SecurityError`],
26//!   [`authenticate`], [`authorize`], [`build_ctx`],
27//!   [`extract_mtls_subject`] — Aggregat-Ctx aus Auth + ACL + TLS.
28//! - [`TlsConfigError`], [`load_server_config`] — `rustls`-
29//!   ServerConfig-Builder mit PEM-Cert/Key-Loader (§7.1).
30//!
31//! ## Beispiel
32//!
33//! ```rust,no_run
34//! use zerodds_bridge_security::{Acl, AclOp, AuthSubject};
35//!
36//! let subj = AuthSubject::new("alice").with_group("publishers");
37//! let acl = Acl::allow_all();
38//! let _allowed = acl.check(&subj, AclOp::Write, "/topics/trade");
39//! ```
40
41#![forbid(unsafe_code)]
42#![warn(missing_docs)]
43
44pub mod acl;
45pub mod auth;
46pub mod connection;
47pub mod ctx;
48pub mod tls;
49
50pub use acl::{Acl, AclEntry, AclOp};
51pub use auth::{AuthError, AuthMode, AuthSubject};
52pub use connection::{
53    RotatingTlsConfig, build_client_tls_connector, parse_server_name, serve_tls_handshake,
54};
55pub use ctx::{
56    SecurityConfig, SecurityCtx, SecurityError, authenticate, authorize, build_ctx,
57    extract_mtls_subject,
58};
59pub use tls::{TlsConfigError, load_server_config};
zerodds_bridge_security/lib.rs

zerodds_bridge_security/
lib.rs
