Crate agentguard_auth

Authentication for agentguard.

Implements JWT validation (RFC 7519 + 8725 BCP), OIDC discovery (RFC 8414), API key management, DPoP verification (RFC 9449), and SPIFFE/SPIRE X509-SVID verification.

The JOSE primitives (Algorithm, KeyMaterial, KeyRegistry, parse_alg) live in agentguard_core::auth_keys and are re-exported here for convenience.

Re-exports

pub use api_key::ApiKey;

pub use api_key::ApiKeyIdentity;

pub use api_key::ApiKeyStore;

pub use dpop::AsyncDpopReplayStore;

pub use dpop::DpopReplayStore;

pub use dpop::DpopVerifier;

pub use error::AuthError;

pub use jti::JtiTracker;

pub use jwt::JwtConfig;

pub use jwt::JwtValidator;

pub use jwt::ValidatedJwt;

pub use oidc::OidcConfig;

pub use oidc::OidcMetadata;

pub use spiffe::SpiffeValidator;

Modules

api_key

API key management.

dpop

DPoP (RFC 9449) proof-of-possession verifier.

error

Error types for agentguard-auth.

jti

jti tracker for replay protection.

jwt

JWT validation per RFC 7519 + RFC 8725 BCP.

oidc

OIDC discovery (RFC 8414) + JWKS population.

spiffe

SPIFFE/SPIRE X509-SVID verifier.

Structs

KeyRegistry

Thread-safe registry of trusted verification keys, keyed by kid.

Enums

Algorithm

JWS signing algorithm (RFC 7518, RFC 8725 §3.1).

KeyMaterial

Key material — abstracted so the registry can hold heterogeneous keys.

Constants

SUPPORTED_ALGORITHMS

Algorithms the JWT/DPoP verifiers actually implement today. Exposed so JwtConfig::with_algorithms can validate input and surface a construction-time error for unsupported values (RS256/ES256 are parsed but not verified in this release).

Functions

parse_alg

Parse a JOSE algorithm name into our Algorithm enum.