aura_authorization/
lib.rs

1//! # Aura Web of Trust - Layer 2: Specification (Domain Crate)
2//!
3//! **Purpose**: Define trust and authorization semantics with capability refinement.
4//!
5//! Authority-based authorization system using Biscuit tokens for cryptographically
6//! verifiable capability delegation. This crate implements the Web of Trust layer
7//! from Aura's architectural model, providing Biscuit-based authorization with
8//! authority-centric resource scopes.
9//!
10//! # Architecture Constraints
11//!
12//! **Layer 2 depends only on aura-core** (foundation).
13//! - ✓ Capability refinement logic (meet-semilattice `⊓`)
14//! - ✓ Biscuit token helpers and semantics (no cryptographic operations)
15//! - ✓ Authorization domain types and policies
16//! - ✗ NO cryptographic signing (that's aura-effects via CryptoEffects)
17//! - ✗ NO handler composition (that's aura-composition)
18//! - ✗ NO multi-party protocol logic (that's aura-protocol)
19//!
20//! # Authorization System
21//!
22//! The crate provides:
23//! - Biscuit token model and verification semantics
24//! - Authority-centric resource scopes (AuthorityOp, ContextOp)
25//! - Capability refinement with attenuation rules
26//! - Policy evaluation patterns (datalog-based)
27//!
28//! ## Usage
29//!
30//! ```rust
31//! use aura_authorization::{ResourceScope, AuthorityOp};
32//! use aura_core::{AuthorityId};
33//!
34//! // Authority-based resource authorization
35//! let resource = ResourceScope::Authority {
36//!     authority_id: AuthorityId::new_from_entropy([1u8; 32]),
37//!     operation: AuthorityOp::UpdateTree,
38//! };
39//! // Token verification handles cryptographic delegation chains
40//! ```
41
42pub mod errors;
43
44// Application effects implementation (Layer 2 pattern)
45/// Typed capability families shared across authorization policy surfaces.
46pub mod capabilities;
47pub mod effect_policy;
48pub mod effects;
49pub mod flow_budget;
50pub mod proposals;
51
52// Biscuit-based authorization
53pub mod biscuit_authorization;
54pub mod biscuit_token;
55pub mod facts;
56pub mod resource_scope;
57pub mod storage_authorization;
58
59pub use errors::{WotError, WotResult};
60
61// Application effect handler re-export
62pub use effects::WotAuthorizationHandler;
63
64// Re-export semilattice traits for convenience
65pub use aura_core::semilattice::{MeetSemiLattice, Top};
66
67// Re-export Biscuit types
68pub use biscuit_auth::{Biscuit, KeyPair, PublicKey};
69pub use biscuit_token::{
70    BiscuitError, BiscuitTokenManager, SerializableBiscuit, TokenAuthority, TokenGrantProfile,
71};
72pub use flow_budget::JournalBackedFlowBudgetHandler;
73
74// Re-export fact types for journal integration
75pub use facts::{WotFact, WotFactDelta, WotFactReducer, WOT_FACT_TYPE_ID};
76
77// Authority-based resource scopes from core
78pub use aura_core::types::scope::{AuthorityOp, ContextOp, ResourceScope};
79
80// Biscuit authorization types
81pub use biscuit_authorization::{AuthorizationResult, BiscuitAuthorizationBridge};
82
83// Storage authorization types
84pub use storage_authorization::{
85    check_biscuit_access, evaluate_biscuit_access, AccessDecision, AuthorizedStorageHandler,
86    BiscuitAccessRequest, BiscuitStorageError, BiscuitStorageEvaluator, PermissionMappings,
87    StoragePermission, StorageResource,
88};
89
90/// Type alias for capability meet operation results
91pub type CapResult<T> = Result<T, WotError>;
92
93// Re-export effect policy types
94pub use effect_policy::{
95    ApprovalThreshold, CapabilityRequirement, CeremonyType, EffectDecision, EffectPolicy,
96    EffectPolicyRegistry, EffectTiming, OperationType, SecurityLevel,
97};
98
99// Re-export proposal types for deferred operations
100pub use proposals::{
101    ProposalFact, ProposalFactDelta, ProposalFactReducer, ProposalFailureReason, ProposalState,
102    ProposalStatus, PROPOSAL_FACT_TYPE_ID,
103};
aura_authorization/lib.rs

aura_authorization/
lib.rs
