pas_external/
lib.rs

1#![doc = include_str!("../README.md")]
2
3pub mod audit;
4// Clock port re-export — External Developer consumers can use
5// `pas_external::clock::ArcClock` / `pas_external::clock::FrozenClock`
6// without a separate `ppoppo-clock` dep in their Cargo.toml.
7pub mod clock {
8    pub use ::ppoppo_clock::*;
9}
10// Perimeter Bearer-auth Layer kit — Phase A Slice 4 lifted the kit to
11// `ppoppo_sdk_core::bearer::*`. pas-external 0.11.0 re-exports the
12// kit at `pas_external::bearer::*` (audit decision D — 1-level
13// role-named module, no `oidc::axum::*` nesting) for 3rd-party
14// consumers (RCW/CTW). 1st-party services (chat-auth) import direct
15// from sdk-core (audit decision B). The framework-dep visibility
16// (axum / tower) is signalled by the `axum` feature gate, not by a
17// nested `pas_external::oidc::axum::*` namespace.
18#[cfg(feature = "axum")]
19pub mod bearer {
20    pub use ::ppoppo_sdk_core::bearer::*;
21}
22// `epoch` re-exports the engine `EpochRevocation` port + ships the
23// canonical adapter set (Phase 11.Z, RFC_2026-05-09 §3.5). Gated on
24// `well-known-fetch` because the engine port itself needs `token` and
25// the original `UserinfoFetcher` (deleted in 0.10.0) required the HTTP
26// client (`oauth`) — both implied by the `well-known-fetch` flag.
27// `SharedCacheCache` (0.10.0, RFC_2026-05-08 §4.1) requires the
28// additional `shared-cache` feature for the `ppoppo-infra` adapter dep.
29#[cfg(feature = "well-known-fetch")]
30pub mod epoch;
31pub mod error;
32// `oauth` is the OAuth2 wire-DTO + AuthClient adapter used internally by
33// `oidc::RelyingParty`. As of 0.8.0 it is `pub(crate)` — consumers reach
34// the OIDC RP composition root (`oidc::RelyingParty<S>`) and never the
35// raw OAuth surface. See `oidc::RefreshOutcome` for the boundary type at
36// `RelyingParty::refresh`.
37#[cfg(feature = "oauth")]
38pub(crate) mod oauth;
39#[cfg(feature = "token")]
40pub mod oidc;
41#[cfg(feature = "oauth")]
42pub mod pas_port;
43// `pkce` primitives (`generate_state`, `generate_code_verifier`,
44// `generate_code_challenge`) are SDK plumbing — `oidc::RelyingParty::start`
45// consumes them internally and exposes the resulting state via
46// `AuthorizationRedirect`. As of 0.8.0 the module is `pub(crate)`.
47#[cfg(feature = "oauth")]
48pub(crate) mod pkce;
49// `session_liveness` is intentionally ungated at module level — the
50// 0.10.0 `SessionLiveness` port has no AES / OAuth deps and ships
51// regardless of feature configuration so the verifier slot
52// (`PasJwtVerifier::with_session_liveness`) can reference it under
53// just `feature = "well-known-fetch"`. Internal sub-modules
54// (`cipher`, `liveness`) remain gated on `feature = "session-liveness"`
55// for the AES wrapper + PAS refresh-token check.
56pub mod session_liveness;
57pub mod types;
58
59// Test-support helpers. `FakePasServer` is the SDK-owned wiremock-wrapped
60// fake PAS Authorization Server, replacing the 0.7.x
61// `RelyingParty::for_test_with_parts` escape hatch. Consumer integration
62// tests construct a real `RelyingParty::new(...)` against
63// `FakePasServer.issuer_url()` so production and test go through the same
64// public interface.
65#[cfg(feature = "test-support")]
66pub mod test_support;
67
68// Re-exports for convenient access
69pub use audit::{
70    AuditEvent, AuditSink, IdTokenFailureKind, MemoryRateLimiter, NoopAuditSink, RateLimitKey,
71    RateLimitedAuditSink, RateLimiter, VerifyErrorKind, compose_id_token_source_id,
72    compose_source_id,
73};
74#[cfg(any(test, feature = "test-support"))]
75pub use audit::MemoryAuditSink;
76pub use error::{Error, TokenError};
77// 0.10.0 — ungated L2 verifier-slot port (RFC_2026-05-08 §4.2 lock).
78pub use session_liveness::{SessionLiveness, SessionLivenessError};
79#[cfg(feature = "session-liveness")]
80pub use session_liveness::{
81    CipherError, EncryptedRefreshToken, LivenessFailure, LivenessOutcome, RevokeCause,
82    TokenCipher, TransientCause, attempt_liveness_refresh,
83};
84// γ port-and-adapter — Phase 6.1 (D-04 = γ, locked 2026-05-05).
85// Phase A (RFC `RFC_2026-05-08_app-credential-collapse.md`, audit
86// decisions E + G) lifted the cohesive verifier group to
87// `ppoppo_sdk_core::verifier::*`. pas-external re-exports at top level
88// (no `token::` namespace — audit decision E) so consumer code
89// reaches `pas_external::{BearerVerifier, JwtVerifier, ...}`. Renames:
90// `PasJwtVerifier` → `JwtVerifier`; `Expectations` → `VerifyConfig`;
91// `AuthSession` → `VerifiedClaims`. The `crypto-side` `VerifyError`
92// re-exports as `TokenVerifyError` (BREAKING) to make space for the
93// Layer-side `VerifyError` from `pas_external::bearer::*` (Slice 4
94// migration). Phase A 0.11.0 ships clean — no transitional alias.
95#[cfg(feature = "token")]
96pub use ::ppoppo_sdk_core::verifier::{
97    BearerVerifier, VerifiedClaims, VerifyConfig, VerifyError as TokenVerifyError,
98};
99#[cfg(feature = "well-known-fetch")]
100pub use ::ppoppo_sdk_core::verifier::{JwksCache, JwtVerifier};
101#[cfg(all(feature = "token", any(test, feature = "test-support")))]
102pub use ::ppoppo_sdk_core::verifier::MemoryBearerVerifier;
103// OIDC RP surface — composition root + post-verify shapes + ports.
104// `RelyingParty<S>` is the consumer-facing entry point; `RefreshOutcome`
105// is the typed boundary return for `RelyingParty::refresh` (replaces
106// the 0.7.x `oauth::TokenResponse` re-export).
107#[cfg(feature = "token")]
108pub use oidc::{Address, IdAssertion, IdTokenVerifier, IdVerifyError, Nonce, ScopePiiReader};
109#[cfg(all(feature = "token", any(test, feature = "test-support")))]
110pub use oidc::MemoryIdTokenVerifier;
111pub use types::{KeyId, Ppnum, PpnumId, SessionId, UserId};
112// `Url` is consumer-facing via `Config::new(client_id, redirect_uri: Url, ...)`
113// and `Discovery::for_test`. Re-exported so consumers reach the same `url`
114// crate version the SDK uses without separately tracking it in their
115// Cargo.toml.
116#[cfg(feature = "oauth")]
117pub use url::Url;
pas_external/lib.rs

pas_external/
lib.rs
