pas_external/oidc/
mod.rs

1//! γ port-and-adapter SDK boundary for OpenID Connect Relying Party
2//! (RP) integration.
3//!
4//! Phase 10.11 — sibling of [`crate::token`]. Where `token::*` exposes
5//! the [`BearerVerifier`](crate::BearerVerifier) port for RFC 9068
6//! access-token verification (the resource-server side of OAuth), this
7//! module exposes [`IdTokenVerifier`] for OIDC id_token verification
8//! (the user-authentication side). The two are intentionally disjoint:
9//! id_tokens authenticate the user *to the RP*, access_tokens authorize
10//! the RP *to the resource server* (OIDC Core §1.2 / RFC 9068 §1).
11//!
12//! Phase 11.A — adds [`RelyingParty<S>`] composition root + the
13//! [`StateStore`] port + `discovery` primitive. The verify-half
14//! ([`IdTokenVerifier`] + [`PasIdTokenVerifier`]) stays as the
15//! resource-side surface; [`RelyingParty<S>`] composes both halves
16//! (start_authorization → callback completion) for the user-flow side.
17//!
18//! ── Module layout — mirrors [`crate::token`] for parallel structure ─────
19//!
20//! - [`port`] — [`IdTokenVerifier`], [`IdAssertion`], [`IdVerifyError`]
21//!   (always compiled when `token` feature is on; depends on engine
22//!   `ScopeSet` / `Nonce` types).
23//! - [`verifier`] — [`PasIdTokenVerifier<S>`] production adapter (gated
24//!   `well-known-fetch`; depends on the engine's id_token verify entry
25//!   and a TTL-cached JWKS).
26//! - [`memory`] — [`MemoryIdTokenVerifier<S>`] +
27//!   [`InMemoryStateStore`] test-support adapters (gated
28//!   `cfg(any(test, feature = "test-support"))`).
29//! - [`state_store`] — [`StateStore`] port + value types ([`Config`],
30//!   [`State`], [`RelativePath`], [`PendingAuthRequest`],
31//!   [`AuthorizationRedirect`], [`CallbackParams`], [`Completion<S>`])
32//!   (gated `feature = "oauth"` + `feature = "token"`; Phase 11.A).
33//! - [`discovery`] — `fetch_discovery` primitive for OIDC
34//!   well-known-openid-configuration documents (gated
35//!   `feature = "well-known-fetch"`; Phase 11.A).
36//! - [`relying_party`] — [`RelyingParty<S>`] composition root (gated
37//!   `feature = "well-known-fetch"`; Phase 11.A skeleton, Phase 11.B
38//!   impl).
39//!
40//! ── Phase 9 inheritance — [`AuditSink`] reuse ───────────────────────────
41//!
42//! Verify-failure emission travels through the same
43//! [`AuditSink`](crate::AuditSink) port that [`PasJwtVerifier`](crate::JwtVerifier)
44//! uses. One audit pipeline serves both verifiers; consumers pass the
45//! same `Arc<dyn AuditSink>` to both `with_audit` builders. The
46//! [`VerifyErrorKind`](crate::VerifyErrorKind) enum gains an
47//! `IdToken(_)` nested variant in 10.11.B so dashboard pivots can
48//! filter "all id_token failures" with a single match arm.
49//!
50//! ── Scope re-exports ────────────────────────────────────────────────────
51//!
52//! The engine's [`scopes`](ppoppo_token::id_token::scopes) markers are
53//! re-exported here so consumers reach them via the SDK boundary:
54//!
55//! ```ignore
56//! use pas_external::oidc::{IdTokenVerifier, Openid, Email, EmailProfile};
57//! ```
58//!
59//! rather than depending on `ppoppo-token` directly. This preserves the
60//! γ invariant: the engine type never crosses the SDK boundary except
61//! through SDK-shaped re-exports.
62
63#[cfg(feature = "token")]
64pub mod port;
65
66#[cfg(feature = "well-known-fetch")]
67pub(crate) mod verifier;
68
69#[cfg(all(feature = "token", feature = "oauth"))]
70pub mod state_store;
71
72/// Thin re-export of `ppoppo_sdk_core::discovery::*` — Phase A Slice 2
73/// moved the primitive to sdk-core so any RP composition root (today
74/// pas-external; tomorrow pas-plims / pcs-external) consumes the same
75/// `fetch_discovery` + `Discovery` + `DiscoveryError` shapes.
76#[cfg(feature = "well-known-fetch")]
77pub mod discovery {
78    pub use ::ppoppo_sdk_core::discovery::*;
79}
80
81#[cfg(feature = "well-known-fetch")]
82pub mod relying_party;
83
84#[cfg(feature = "well-known-fetch")]
85pub mod refresh_outcome;
86
87#[cfg(all(feature = "token", any(test, feature = "test-support")))]
88pub mod memory;
89
90// Phase A Slice 4 — perimeter `BearerAuthLayer` Layer kit moved to
91// `ppoppo_sdk_core::bearer::*` so 1st-party services (chat-auth) can
92// import direct (audit decision B). pas-external re-exports the kit at
93// the crate root as `pas_external::bearer::*` for 3rd-party RCW/CTW
94// consumers (audit decision D — 1-level role-named module, no nesting).
95// No `oidc::axum::*` namespace remains — see crate root `bearer` module
96// in this crate's `lib.rs`.
97
98#[cfg(feature = "token")]
99pub use port::{Address, IdAssertion, IdTokenVerifier, IdVerifyError, ScopePiiReader};
100
101#[cfg(all(feature = "token", feature = "oauth"))]
102pub use state_store::{
103    AuthorizationRedirect, CallbackParams, Completion, Config, PendingAuthRequest, RelativePath,
104    RelativePathError, State, StateStore, StateStoreError,
105};
106
107#[cfg(feature = "well-known-fetch")]
108pub use discovery::{fetch_discovery, Discovery, DiscoveryError};
109
110#[cfg(feature = "well-known-fetch")]
111pub use relying_party::{
112    CallbackError, RefreshError, RelyingParty, RelyingPartyInitError, RequestedScope, StartError,
113};
114
115#[cfg(feature = "well-known-fetch")]
116pub use refresh_outcome::RefreshOutcome;
117
118#[cfg(all(feature = "token", any(test, feature = "test-support")))]
119pub use memory::MemoryIdTokenVerifier;
120
121#[cfg(all(
122    feature = "token",
123    feature = "oauth",
124    any(test, feature = "test-support")
125))]
126pub use memory::InMemoryStateStore;
127
128// Engine re-exports — consumers reach scope markers + Nonce via the SDK
129// boundary rather than depending on `ppoppo-token` directly.
130#[cfg(feature = "token")]
131pub use ppoppo_token::id_token::{
132    Nonce,
133    scopes::{
134        Email, EmailProfile, EmailProfilePhone, EmailProfilePhoneAddress, HasAddress, HasEmail,
135        HasPhone, HasProfile, Openid, Profile, ScopeSet,
136    },
137};
pas_external/oidc/mod.rs

pas_external/oidc/
mod.rs
