Struct AuthNonceStore 

pub struct AuthNonceStore { /* private fields */ }

cratestack_auth’s nonce store (in-memory, or Redis across replicas), as the cratestack_core::NonceStore a server CoseEnvelope records (kid, cti) in (§5, nonce mode).

Expiry. An entry must outlive expires_at, the instant after which the opener would refuse the request as stale anyway (iat + 2·skew + 1, see replay.rs). Auth’s Redis store turns timestamp + replay_window into a whole-second TTL against its own clock and rounds down, so the bridge claims with timestamp = now and replay_window = (expires_at + 1 s) - now: the key then lives at least until expires_at and at most one second longer. The deadline is computed with checked arithmetic: an expires_at too close to DateTime::<Utc>::MAX_UTC for + 1 s is Internal (a 500) and no claim is made, because auth’s in-memory store adds timestamp + replay_window unchecked and would panic. An expires_at already in the past is reported new, the same answer core’s InMemoryNonceStore gives; what is kept depends on the store: Redis floors the TTL at one second, so the key exists for a second, while auth’s in-memory store inserts an entry that is already expired and ignores it on the next claim. The opener never asks, since it checks freshness first.

Errors. NonceReused is “seen” (Ok(false), the opener’s 401). Every other error means the store could not answer, so it is CratestackError::Internal (a 500, detail kept server-side), never “new”. Answering “new” there would make a Redis outage switch replay protection off.

Deploying the Redis store. Replay protection is only as durable as the key. Run the nonce Redis with maxmemory-policy noeviction: an evicting policy can drop a live nonce under memory pressure and let its message be replayed. Redis replication is asynchronous, so a failover can lose a SET the old primary acknowledged but had not yet replicated, reopening the window for that nonce until it would have expired. Known limitation: auth’s Redis store opens a new connection for every claim (cratestack#1070).

Implementations

impl AuthNonceStore

pub fn new(inner: Arc<dyn NonceStore>) -> AuthNonceStore

Bridge any cratestack_auth::NonceStore.

pub fn redis(redis_url: &str) -> Result<AuthNonceStore, CratestackError>

The Redis-backed store at redis_url, via cratestack_auth::nonce_store_from_redis_url.

Unlike that function, an empty URL is an error, not a silent in-memory fallback: a multi-replica deployment that lost its Redis URL would otherwise get one nonce store per replica, and a request replayed to another replica would be accepted. A deployment that wants the in-memory store asks for it with new.

The URL is only parsed here; the first connection is made on the first request, and a failure then is a 500.

Trait Implementations

impl Clone for AuthNonceStore

fn clone(&self) -> AuthNonceStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthNonceStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl NonceStore for AuthNonceStore

fn record_if_unseen<'life0, 'life1, 'async_trait>( &'life0 self, nonce: &'life1 str, expires_at: DateTime<Utc>, ) -> Pin<Box<dyn Future<Output = Result<bool, CratestackError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, AuthNonceStore: 'async_trait,

Attempt to register nonce as seen. Returns Ok(true) if it is the first time we see it (caller may proceed); Ok(false) if it was already recorded (caller should reject). Implementations must drop entries past expires_at to keep the working set bounded.