systemprompt_security/lib.rs
1//! Security infrastructure for systemprompt.io.
2//!
3//! Houses the request-level authentication primitives shared by the HTTP
4//! API and the runtime layer:
5//!
6//! - JWT minting ([`jwt`]) for admin tokens and ([`session`]) for
7//! session-scoped tokens.
8//! - Token extraction ([`extraction`]) from `Authorization` headers, MCP proxy
9//! headers, and cookies.
10//! - Request validation ([`auth`]) that turns those tokens into a
11//! [`systemprompt_models::execution::context::RequestContext`].
12//! - Cowork manifest signing ([`manifest_signing`]) with Ed25519 keys.
13//! - Lightweight scanner / bot detection ([`services`]).
14//!
15//! All public fallible APIs return typed errors from [`error`] — `anyhow`
16//! is not used in any public signature.
17//!
18//! # Feature flags
19//!
20//! This crate has no Cargo features; everything compiles by default.
21//!
22//! # Example
23//!
24//! ```no_run
25//! use systemprompt_models::auth::JwtAudience;
26//! use systemprompt_security::{AuthMode, AuthValidationService};
27//!
28//! # fn demo(headers: &axum::http::HeaderMap) -> systemprompt_security::AuthResult<()> {
29//! let svc = AuthValidationService::new(
30//! "secret".to_string(),
31//! "systemprompt.io".to_string(),
32//! vec![JwtAudience::standard()],
33//! );
34//! let _ctx = svc.validate_request(headers, AuthMode::Required)?;
35//! # Ok(())
36//! # }
37//! ```
38
39pub mod auth;
40pub mod error;
41pub mod extraction;
42pub mod jwt;
43pub mod manifest_signing;
44pub mod services;
45pub mod session;
46
47pub use auth::{AuthMode, AuthValidationService};
48pub use error::{
49 AuthError, AuthResult, JwtError, JwtResult, ManifestSigningError, ManifestSigningResult,
50};
51pub use extraction::{
52 CookieExtractionError, CookieExtractor, ExtractionMethod, HeaderExtractor,
53 HeaderInjectionError, HeaderInjector, TokenExtractionError, TokenExtractor,
54};
55pub use jwt::{AdminTokenParams, JwtService};
56pub use services::ScannerDetector;
57pub use session::{SessionGenerator, SessionParams, ValidatedSessionClaims};