av_identity/lib.rs
1//! Ephemeral Non-Human Identity (NHI) validation — brief Module D.
2//!
3//! Short-lived JWTs (EdDSA primary, HS256 for dev/IdP-shared-secret setups)
4//! with a hard 15-minute TTL cap, plus cryptographically enforced scope
5//! inheritance for parent→child agent delegation: a child token carries its
6//! parent's token; the chain is signature-verified link by link and every
7//! link's scopes must be a subset of its parent's, with `child.exp ≤
8//! parent.exp` and bounded chain depth.
9//!
10//! Adversarial coverage (tests): `alg=none`, algorithm confusion (HS256
11//! header against an Ed25519 key), expired / not-yet-valid, oversized TTL,
12//! scope escalation at any link, truncated & tampered tokens, unknown `kid`.
13
14pub mod claims;
15pub mod validator;
16
17pub use claims::{NhiClaims, MAX_TTL_SECS};
18pub use validator::{IdentityError, IdentityValidator, KeyMaterial, ValidatedIdentity};