Crate issuerd_server 

Modules

bootstrap

broker

Identity brokering: the production BrokerClient and the orchestration that turns an external authorization code into a verified BrokeredIdentity.

claims

Protocol-mapper driven claim assembly.

claims_cache

Epoch-validated cache-aside read model for claims assembly.

client_assertion

JWT client authentication (private_key_jwt / client_secret_jwt) per RFC 7523 §2.2 and OIDC Core §9.

config

discovery_cache

The discovery document is a pure function of the realm row (name, PAR policy, registration toggle, authorization-details types) and the active signing-key set (advertised algorithms), yet was rebuilt — a dozen URL parses plus a full struct serialization — on every one of the hottest requests an OIDC provider serves.

dpop

DPoP (RFC 9449) endpoint wiring (DPoP chosen over mTLS: it is pure HTTP-header machinery, testable in-process, and needs no TLS termination contract).

email

Outbound email: compile-time embedded templates + lettre SMTP sender.

event_listeners

Built-in event listeners.

groups

Group helpers shared by the interactive user-creation paths.

i18n

UI internationalization.

middleware

openapi

OpenAPI assembly for endpoints owned by issuerd-server: the account console API, the public protocol helpers (login context, token endpoint), and the internal first-party SPA auth API. full_openapi merges these into the admin API document so the emitted spec covers every endpoint the web clients call.

provisioner

qr

QR code rendering for TOTP enrollment.

routes

session_cache

Cache-aside snapshots of user-session validity.

state

tls

typestate

Typestate wrappers for server-side auth lifecycle.

userinfo_cache

Caches the fully rendered userinfo JSON body so a warm-cache request skips user/role/catalog reads, mapper evaluation, and response-tree building entirely — the logical end-point of the claims read-model approach (claims_cache.rs).