Crate pas_external 

pas-external

Ppoppo Accounts System (PAS) client for Rust.

• OAuth2 PKCE authentication flow
• JWT (RFC 9068, EdDSA) token verification via JWKS (RFC 7517)
• OIDC (OpenID Connect 1.0) ID-token verification via oidc::RelyingParty<S>
• Axum middleware for plug-and-play auth routes

Usage

[dependencies]
pas-external = { version = "0.1", features = ["axum"] }

For downstream consumer integration tests, enable test-support to access MemoryPasAuth (deterministic in-memory PAS substitute, FIFO-scripted):

[dev-dependencies]
pas-external = { version = "0.1", features = ["axum", "test-support"] }

Pre-1.0: minor bumps (0.2, 0.3) may include breaking changes per SemVer §11. Versions 1.0.1 – 5.0.0 were yanked from crates.io on 2026-04-30 as part of a pre-1.0 version reset; 0.1.0 is equivalent in scope to the (yanked) 5.0.0 development line. See CHANGELOG.md for the design history and the monorepo’s ppoppo/0context/STANDARDS_SESSION_LIVENESS.md for the consumer-facing contract.

Re-exports

pub use error::Error;

pub use error::TokenError;

pub use session_liveness::CipherError;

pub use session_liveness::EncryptedRefreshToken;

pub use session_liveness::LivenessFailure;

pub use session_liveness::LivenessOutcome;

pub use session_liveness::RevokeCause;

pub use session_liveness::TokenCipher;

pub use session_liveness::TransientCause;

pub use session_liveness::attempt_liveness_refresh;

pub use oidc::Address;

pub use oidc::IdAssertion;

pub use oidc::IdTokenVerifier;

pub use oidc::IdVerifyError;

pub use oidc::ScopePiiReader;

pub use oidc::MemoryIdTokenVerifier;

pub use scope_grant::ScopeNotCovered;

pub use scope_grant::ensure_covers;

pub use native::CallbackError;

pub use native::NativeAuthFlow;

pub use native::NativeAuthInitError;

pub use native::NativeConfig;

pub use refresh_source::MemoryTokenStore;

pub use refresh_source::RefreshTokenSource;

pub use refresh_source::TokenStore;

pub use refresh_source::TokenStoreError;

Modules

audit

M48 audit trait + types — re-exported from ppoppo-sdk-core.

bearer

clock

epoch

sv-axis (session_version) enforcement port + first-party adapters.

error

native

Native-app OAuth composition root — the non-OIDC sibling of RelyingParty.

oidc

γ port-and-adapter SDK boundary for OpenID Connect Relying Party (RP) integration.

pas_port

PAS network-boundary port and deep refresh core.

refresh_source

Renewing TokenSource — refresh-grant + rotated-token persistence

scope_grant

Granted-vs-requested scope validation (RFC 6749 §5.1).

session_liveness

Session liveness — two complementary axes.

test_support

Test-support helpers for consumer integration tests.

types

SDK identity types — re-exported from ppoppo-sdk-core.

Structs

AuditEvent

Single typed event emitted on every BearerVerifier::verify rejection.

AuthClient

OAuth2 authorization client for Ppoppo Accounts.

JwksCache

Refresh-on-demand JWKS cache. Constructed by super::JwtVerifier::from_jwks_url and consumed via Self::snapshot on every verify.

JwtVerifier

PAS JWT verifier (RFC 9068, EdDSA).

KeyId

PASERK key identifier.

MemoryAuditSink

Test-support sink — accumulates events in insertion order behind a Mutex.

MemoryBearerVerifier

In-memory verifier — pre-registered token → VerifiedClaims map.

MemoryRateLimiter

In-memory token-bucket limiter — Phase 9 default substrate.

Nonce

Opaque nonce value. Construction validates non-emptiness; the inner string is private so callers cannot bypass the invariant by minting Nonce(String::new()) directly.

NoopAuditSink

Default sink — explicitly does nothing.

Ppnum

Validated Ppoppo Number (≥11 digits, ASCII digits only).

PpnumId

PAS ppnum identifier (OAuth sub claim, ULID format).

RateLimitKey

Opaque per-source bucket key for a RateLimiter.

RateLimitedAuditSink

Wraps any AuditSink with any RateLimiter.

SessionId

Consumer-defined session identifier (opaque string).

Url

A parsed URL record.

UserId

Consumer-defined user identifier (opaque string).

VerifiedClaims

Verified bearer-token outcome, opaque to the underlying token format.

VerifyConfig

Per-deployment expectations folded into the verifier at construction.

Enums

EpochEnforcement

Required typed stance on the sv epoch axis (RFC_202607150428 §7 Q3, resolved 2026-07-17).

IdTokenFailureKind

id_token-specific failure classification (Phase 10.11.B).

SessionLivenessError

Per-request liveness failure surface.

TokenVerifyError

VerifyErrorKind

Failure classification — mirrors the VerifyError and IdVerifyError surfaces but lives at the audit layer.

Traits

AuditSink

Audit emission port for verify-failure events (M48).

BearerVerifier

Verification port for incoming bearer tokens.

ConsentScopes

The OAuth2 scope atoms a marker type requests at consent.

RateLimiter

Per-source rate-limiting port (M49).

ScopedTokenSource

A TokenSource whose credential has been checked to cover S’s atoms.

SessionLiveness

Per-request session-row liveness check.

Functions

compose_id_token_source_id

Phase 10.11.D δ2 — id_token compound source key from azp ‖ aud ‖ kid.

compose_source_id

Compose a Phase 9 (e) compound source key from optional hints.