Crate delegated_redis 

delegated-redis

Redis-backed TrustStateStore and TrustStateAdmin for multi-instance delegated deployments.

Install

[dependencies]
delegated = "0.2"
delegated-redis = "0.2"

Usage

use chrono::Utc;
use delegated::{Evaluator, OperationContext, PinnedIssuerKeys};
use delegated_redis::RedisTrustState;

let keys = PinnedIssuerKeys::new();
// load trusted issuer keys into `keys` from configuration

let state = RedisTrustState::new("redis://127.0.0.1/")?;
let operation = OperationContext::new("calendar-api", "calendar.create")
    .with_resource("calendar:alice");

let (decision, _audit) =
    Evaluator::new(&keys, &state).evaluate(request, &operation, Utc::now());

Administrative mutations:

use delegated::TrustStateAdmin;
use delegated_redis::RedisTrustState;

let state = RedisTrustState::with_prefix("redis://127.0.0.1/", "prod-api")?;
state.revoke_token("https://issuer.example", "token-123")?;
state.deny_agent("https://issuer.example", "agent:compromised")?;

Nonce consumption uses SET key NX EX ttl so concurrent evaluators share replay protection. Revocation and emergency-deny entries persist until operators remove them.

Documentation

• API reference
• Operations guide
• Integration guide (Redis section)
• Reference stack example

Requirements

• Redis 6+ reachable from every evaluator instance
• A unique key prefix per environment when multiple services share one cluster
• The core delegated crate for evaluation Redis-backed trust state for delegated evaluators.

This crate provides RedisTrustState, a production-oriented implementation of TrustStateStore and TrustStateAdmin using Redis atomic SET NX for nonce consumption and persistent flags for revocation and emergency deny.

See the operations guide for key layout, Sentinel/cluster notes, and lifecycle procedures.

Structs

RedisTrustState

Shared trust state backed by Redis SET NX EX nonce consumption.