pub struct FleetAuth<P: StateProtection> { /* private fields */ }Expand description
Local decoded Principals plus fleet-native live sessions and replay state. Backing follows the supplied Fleet. SHM survives handle drop and restart; memory state lives as long as a handle retains it. No background driver.
Shared records contain only keyed identifiers and fixed control metadata.
Owner-only OS permissions restrict access. Blake3State verifies
integrity; EncryptedState also hides metadata. UnprotectedState explicitly
trusts every writer. Protected modes still permit deletion/rollback attacks.
state_key stays stable across token-key rotations and is never stored in SHM.
Implementations§
Source§impl<P: StateProtection> FleetAuth<P>
impl<P: StateProtection> FleetAuth<P>
Sourcepub fn new(
fleet: Arc<Fleet>,
authority: &Authority,
state_key: SecretKey,
local_capacity: NonZeroUsize,
_policy: P,
) -> Result<Self>
pub fn new( fleet: Arc<Fleet>, authority: &Authority, state_key: SecretKey, local_capacity: NonZeroUsize, _policy: P, ) -> Result<Self>
Construct with an explicitly selected shared-state protection policy. There is no default policy.
local_capacity bounds each local Principal/session-view LRU. A cached
protected view is reused only while every shared byte matches its local copy.
UnprotectedState trusts the commit revision instead.
Peers sharing a physical table must select the same policy. Token crypto
and live session/replay checks are enabled for every policy.
Sourcepub fn clear_local(&self)
pub fn clear_local(&self)
Clear this handle’s decoded/validated views; shared authority is preserved.
pub fn create_session( &self, subject: impl Into<String>, now: u64, expires_at: u64, ) -> Result<Session>
Sourcepub fn revoke_session(&self, id: SessionId, now: u64) -> Result<()>
pub fn revoke_session(&self, id: SessionId, now: u64) -> Result<()>
Atomically publish revocation. Every subsequent validation rechecks the authenticated record, including warm local cache hits. Already admitted work is not cancelled; no notification or polling interval delays the next check.
Sourcepub fn refresh(
&self,
validator: &Validator<'_>,
token: &str,
now: u64,
expires_at: u64,
) -> Result<Session>
pub fn refresh( &self, validator: &Validator<'_>, token: &str, now: u64, expires_at: u64, ) -> Result<Session>
Validate and consume the current refresh generation atomically. Exactly one concurrent caller succeeds. The explicit renewed expiry may preserve or extend the previous horizon. The returned handle issues new credentials. The application owns renewal/delegation limits. If a response is lost, the consumed credential is not retried; reauthentication is required.
Sourcepub fn replay_guard(&self) -> ReplayGuard<'_, P>
pub fn replay_guard(&self) -> ReplayGuard<'_, P>
One-use hook. Unexpired consumed IDs never evict; full/unavailable denies.