orbit_auth/protection.rs
1//! Type-level selection of shared-state protection, independent of token crypto.
2
3mod sealed {
4 pub trait Sealed {}
5}
6
7/// One protection policy for a physical auth table. Implementations are sealed:
8/// the selected type defines a fixed wire contract, not a negotiable algorithm.
9pub trait StateProtection: sealed::Sealed + Send + Sync + 'static {
10 #[doc(hidden)]
11 const ID: u64;
12}
13
14/// Visible control metadata authenticated with full keyed BLAKE3 tags.
15#[derive(Clone, Copy, Debug, Default)]
16pub struct Blake3State;
17
18/// Control metadata encrypted and authenticated with XChaCha20-Poly1305.
19/// Verified plaintext remains in the worker's private local session cache.
20#[derive(Clone, Copy, Debug, Default)]
21pub struct EncryptedState;
22
23impl sealed::Sealed for Blake3State {}
24impl sealed::Sealed for EncryptedState {}
25impl StateProtection for Blake3State {
26 const ID: u64 = 1;
27}
28impl StateProtection for EncryptedState {
29 const ID: u64 = 2;
30}
31
32/// No cryptographic protection of shared control records. Every SHM writer can
33/// forge session/replay state. Warm checks trust the commit revision alone;
34/// writers must publish a new revision for every mutation. Token AEAD, expiry
35/// and live-state checks remain.
36/// Choose explicitly only when all writers are trusted.
37#[derive(Clone, Copy, Debug, Default)]
38pub struct UnprotectedState;
39impl sealed::Sealed for UnprotectedState {}
40impl StateProtection for UnprotectedState {
41 const ID: u64 = 3;
42}