edda_auth/lib.rs
1//! Identity and authentication for Edda.
2//!
3//! Every device (a player's laptop, the DM's phone) holds an Ed25519
4//! [`DeviceKey`] that never leaves it. A campaign's DM devices vouch for
5//! other devices by signing a [`DeviceCert`]; the auth service only accepts
6//! devices with a valid certificate. To use the services, a device answers a
7//! login challenge by signing it, and gets a short-lived token (PASETO
8//! v4.public) that every service can check with the auth service's public
9//! key alone.
10//!
11//! Anything signed is signed as `"edda/v1/<purpose>\0"` followed
12//! by the value's canonical (postcard) encoding, so a signature made for one
13//! purpose can never be passed off as another.
14
15mod bytes;
16mod cert;
17mod keys;
18pub mod pairing;
19pub mod protocol;
20#[cfg(feature = "server")]
21pub mod server;
22
23pub use cert::{DeviceCert, Role, SignedCert};
24pub use keys::{DeviceKey, Nonce, PublicKey, Purpose, Signature};
25
26/// What can go wrong with keys, signatures and tokens.
27#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
28pub enum AuthError {
29 #[error("not a valid public key")]
30 InvalidKey,
31 #[error("signature does not match")]
32 BadSignature,
33 #[error("invalid encoding: {0}")]
34 Encoding(String),
35 #[error("invalid or expired token")]
36 InvalidToken,
37}