Crate edda_auth 

Identity and authentication for Edda.

Every device (a player’s laptop, the DM’s phone) holds an Ed25519 DeviceKey that never leaves it. A campaign’s DM devices vouch for other devices by signing a DeviceCert; the auth service only accepts devices with a valid certificate. To use the services, a device answers a login challenge by signing it, and gets a short-lived token (PASETO v4.public) that every service can check with the auth service’s public key alone.

Anything signed is signed as "edda/v1/<purpose>\0" followed by the value’s canonical (postcard) encoding, so a signature made for one purpose can never be passed off as another.

Modules

pairing

Pairing a new device with a short code, using a PAKE (SPAKE2).

protocol

Requests and responses of the auth service, and what tokens say.

server

For services: issuing and checking tokens, and an axum extractor.

Structs

DeviceCert

A statement that device belongs to campaign with role, signed by issuer: a DM device of that campaign, or for the very first DM device (set up with a one-time code) the device itself.

DeviceKey

A device’s private signing key. Generated on the device and never sent anywhere.

Nonce

32 random bytes, for challenges. Shown as unpadded base64url.

PublicKey

An Ed25519 public key. Shown as unpadded base64url.

Signature

An Ed25519 signature. Shown as unpadded base64url.

SignedCert

A DeviceCert with its issuer’s signature.

Enums

AuthError

What can go wrong with keys, signatures and tokens.

Purpose

What a signature is for. Part of every signed message, so a signature can’t be reused for a different purpose than the one it was made for.

Role

What a device may do in its campaign.