av_identity/
lib.rs

1//! Ephemeral Non-Human Identity (NHI) validation — brief Module D.
2//!
3//! Short-lived JWTs (EdDSA primary, HS256 for dev/IdP-shared-secret setups)
4//! with a hard 15-minute TTL cap, plus cryptographically enforced scope
5//! inheritance for parent→child agent delegation: a child token carries its
6//! parent's token; the chain is signature-verified link by link and every
7//! link's scopes must be a subset of its parent's, with `child.exp ≤
8//! parent.exp` and bounded chain depth.
9//!
10//! Adversarial coverage (tests): `alg=none`, algorithm confusion (HS256
11//! header against an Ed25519 key), expired / not-yet-valid, oversized TTL,
12//! scope escalation at any link, truncated & tampered tokens, unknown `kid`.
13
14pub mod claims;
15pub mod exchange;
16pub mod revocation;
17pub mod validator;
18pub mod workload;
19
20pub use claims::{ActorClaim, Audience, NhiClaims, MAX_TTL_SECS};
21pub use exchange::{
22    build_exchanged_claims, build_exchanged_claims_with_actor, check_exchanged_revocation,
23    scope_intersection, verify_exchanged_token, ExchangeActor, ExchangeError, ExchangeParams,
24    ExchangedClaims, ExchangedValidation, TokenExchangeRequest, TokenExchangeResponse,
25    TOKEN_EXCHANGE_GRANT_TYPE,
26};
27pub use revocation::{
28    InMemoryRevocationStore, RevocationHealth, RevocationIdentity, RevocationStore, RevokeOutcome, RevokedBy,
29};
30pub use validator::{IdentityError, IdentityValidator, KeyMaterial, ValidatedIdentity};
31pub use workload::{
32    CfInstanceIdentity, VerifiedAssertion, WorkloadError, WorkloadTrust, JWT_BEARER_GRANT_TYPE,
33    MAX_ASSERTION_LIFETIME_S,
34};
av_identity/lib.rs

av_identity/
lib.rs
