Module auth 

cratestack-auth integration: the auth Cargo feature (ADR 0006, “Decisions taken while scoping P0”; cratestack#1005 part B).

• ServiceKeySigner: a cratestack_auth::ServiceSigningKey as a CoseSigner, for service-to-service Sign1.
• DeviceKeyCoseResolver: a cratestack_auth::DeviceKeyResolver as a CoseVerifierResolver, for device requests (§8: “indexed additionally by thumbprint prefix”).
• AuthNonceStore: cratestack_auth’s nonce store (in-memory or Redis) as cratestack_core::NonceStore, for multi-replica nonce replay protection (§5), keyed by (kid, cti).
• build_cose_enroll_response / parse_cose_enroll_response: the enrolment challenge code, moved here from cratestack-auth (a breaking change). It is a separate, older COSE shape and does not go through the envelope’s strict opener (see its module docs).
• CoseAuthProvider: an AuthProvider that authenticates a COSE-verified signer through the service key registry and, once authenticate_devices(true) opts in, the device key registry (cratestack#1077). Unknown or revoked keys, and device keys while the gate is off, are anonymous; a failing registry that is asked is a 500. It is first_success(inner).or(CoseSignerProvider), the public chain (cratestack#1243); compose the signer provider yourself to put it in a chain of your own. The service registry must hold service keys only. Read its “Security” section.

The dependency points one way, cratestack-cose -> cratestack-auth (L2 -> L1, docs/adr/layers.toml). Without the feature this crate depends on cratestack-core alone, so clients and the wasm/napi builds stay free of auth’s Redis, reqwest and rustls dependencies.

The error contract is the envelope’s (§10): an adapter never turns a verification failure into anything but the coarse 401, and a failing backend (the device-key store, the nonce store) is a 500 whose detail stays server-side.

Structs

AuthNonceStore

cratestack_auth’s nonce store (in-memory, or Redis across replicas), as the cratestack_core::NonceStore a server CoseEnvelope records (kid, cti) in (§5, nonce mode).

CoseAuthProvider

Wraps an AuthProvider and authenticates a COSE-verified signer through a service key registry and, once switched on, the device key registry.

CoseSignerProvider

The COSE-verified signer as an AuthProvider. Compose it with another provider through cratestack::first_success(...).or(...), or use CoseAuthProvider, which does exactly that. The “Security” sections of CoseAuthProvider apply unchanged.

DeviceKeyCoseResolver

Resolves COSE_Sign1 device requests through the service’s cratestack_auth::DeviceKeyResolver (ADR 0006 §8), by its required lookup_device_verifying_keys_by_thumbprint.

ServiceKeySigner

A service’s cratestack_auth::ServiceSigningKey signing COSE_Sign1 messages with Ed25519 (-19).

Constants

AUTH_NONCE_KEY_ID

The key_id every bridged nonce is claimed under.

Functions

build_cose_enroll_response

Sign response as an enrolment challenge with the key in [CHALLENGE_SIGNING_KEY_ENV]. Fails closed without that key (see challenge_signing_key). Was cratestack_auth::build_cose_enroll_response.

parse_cose_enroll_response

Verify and decode an enrolment challenge this service signed. The verifying key is derived from the same secret seed ([CHALLENGE_SIGNING_KEY_ENV]): the server checks its own challenge on the way back. It does not check expires_at; the caller must. Was cratestack_auth::parse_cose_enroll_response.