pub struct FleetAuth<P: StateProtection> { /* private fields */ }Expand description
Local decoded Principals plus fleet-native live sessions and replay state. Backing follows the supplied Fleet. SHM survives handle drop and restart; memory state lives as long as a handle retains it. No background driver.
Shared records contain only keyed identifiers and fixed control metadata.
Owner-only OS permissions restrict access. Blake3State verifies
integrity; EncryptedState also hides metadata. UnprotectedState explicitly
trusts every writer. Protected modes still permit deletion/rollback attacks.
state_key stays stable across token-key rotations and is never stored in SHM.
Implementations§
Source§impl<P: StateProtection> FleetAuth<P>
impl<P: StateProtection> FleetAuth<P>
Sourcepub fn new(
fleet: Arc<Fleet>,
authority: &Authority,
state_key: SecretKey,
local_capacity: NonZeroUsize,
_policy: P,
) -> Result<Self>
pub fn new( fleet: Arc<Fleet>, authority: &Authority, state_key: SecretKey, local_capacity: NonZeroUsize, _policy: P, ) -> Result<Self>
Construct with an explicitly selected shared-state protection policy. There is no default policy.
local_capacity bounds each local Principal/session-view LRU. A cached
protected view is reused only while every shared byte matches its local copy.
UnprotectedState trusts the commit revision instead.
Peers sharing a physical table must select the same policy. Token crypto
and live session/replay checks are enabled for every policy.
Sourcepub fn clear_local(&self)
pub fn clear_local(&self)
Clear this handle’s decoded/validated views; shared authority is preserved.
pub fn create_session( &self, subject: impl Into<String>, now: u64, expires_at: u64, ) -> Result<Session>
Sourcepub fn create_session_with_limit(
&self,
subject: impl Into<String>,
now: u64,
expires_at: u64,
limit: NonZeroUsize,
) -> Result<Session>
pub fn create_session_with_limit( &self, subject: impl Into<String>, now: u64, expires_at: u64, limit: NonZeroUsize, ) -> Result<Session>
Admit a new session and revoke the oldest excess sessions of this subject under the same writer lock. The new session is always retained. No new index, shared-memory layout or background driver is introduced.
Sourcepub fn revoke_subject_sessions(&self, subject: &str, now: u64) -> Result<usize>
pub fn revoke_subject_sessions(&self, subject: &str, now: u64) -> Result<usize>
Revoke every live session of this subject in this realm/issuer. Writers are serialized; readers observe each authenticated replacement.
Sourcepub fn extend_subject_sessions(
&self,
subject: &str,
now: u64,
horizon: impl Fn(u64, u64) -> u64,
) -> Result<usize>
pub fn extend_subject_sessions( &self, subject: &str, now: u64, horizon: impl Fn(u64, u64) -> u64, ) -> Result<usize>
Extend live subject sessions using the caller’s declared policy. The callback receives creation and current expiry times. Validate all target horizons before writing; never resurrect or shorten a session.
Sourcepub fn revoke_session(&self, id: SessionId, now: u64) -> Result<()>
pub fn revoke_session(&self, id: SessionId, now: u64) -> Result<()>
Atomically publish revocation. Every subsequent validation rechecks the authenticated record, including warm local cache hits. Already admitted work is not cancelled; no notification or polling interval delays the next check.
Sourcepub fn session(&self, id: SessionId, subject: &str, now: u64) -> Result<Session>
pub fn session(&self, id: SessionId, subject: &str, now: u64) -> Result<Session>
The live session behind an id, for the subject that owns it: a handle a worker that did not create the session uses to issue its credentials or read its horizon. Lock-free; a raced read takes one locked retry.
Sourcepub fn extend_session(
&self,
id: SessionId,
subject: &str,
now: u64,
expires_at: u64,
) -> Result<Session>
pub fn extend_session( &self, id: SessionId, subject: &str, now: u64, expires_at: u64, ) -> Result<Session>
Move a live session’s horizon forward on activity the application
trusts, without a credential and without consuming a refresh generation.
subject must own the session. The horizon never moves back: shortening
a session is revocation. Credentials issued earlier keep their own
expiry; the returned handle issues ones that reach the new horizon.
Sourcepub fn refresh(
&self,
validator: &Validator<'_>,
token: &str,
now: u64,
expires_at: u64,
) -> Result<Session>
pub fn refresh( &self, validator: &Validator<'_>, token: &str, now: u64, expires_at: u64, ) -> Result<Session>
Validate and consume the current refresh generation atomically. Exactly one concurrent caller succeeds. The explicit renewed expiry may preserve or extend the previous horizon. The returned handle issues new credentials. The application owns renewal/delegation limits. If a response is lost, the consumed credential is not retried; reauthentication is required.
Sourcepub fn replay_guard(&self) -> ReplayGuard<'_, P>
pub fn replay_guard(&self) -> ReplayGuard<'_, P>
One-use hook. Unexpired consumed IDs never evict; full/unavailable denies.