agentguard_auth/
lib.rs

1//! Authentication for agentguard.
2//!
3//! Implements JWT validation (RFC 7519 + 8725 BCP), OIDC discovery (RFC 8414),
4//! API key management, DPoP verification (RFC 9449), and SPIFFE/SPIRE X509-SVID
5//! verification.
6//!
7//! The JOSE primitives (`Algorithm`, `KeyMaterial`, `KeyRegistry`,
8//! `parse_alg`) live in `agentguard_core::auth_keys` and are re-exported
9//! here for convenience.
10
11pub mod api_key;
12pub mod dpop;
13pub mod error;
14pub mod jti;
15pub mod jwt;
16pub mod oidc;
17pub mod spiffe;
18
19pub use agentguard_core::auth_keys::{parse_alg, Algorithm, KeyMaterial, KeyRegistry};
20pub use api_key::{ApiKey, ApiKeyIdentity, ApiKeyStore};
21pub use dpop::{AsyncDpopReplayStore, DpopReplayStore, DpopVerifier};
22pub use error::AuthError;
23pub use jti::JtiTracker;
24pub use jwt::{JwtConfig, JwtValidator, ValidatedJwt};
25pub use oidc::{OidcConfig, OidcMetadata};
26pub use spiffe::SpiffeValidator;
27
28/// Algorithms the JWT/DPoP verifiers actually implement today. Exposed
29/// so `JwtConfig::with_algorithms` can validate input and surface a
30/// construction-time error for unsupported values (RS256/ES256 are
31/// parsed but not verified in this release).
32pub const SUPPORTED_ALGORITHMS: &[Algorithm] = &[Algorithm::EdDSA];
agentguard_auth/lib.rs

agentguard_auth/
lib.rs
