crates/nornir-auth-webauthn/src/lib.rs
//! # nornir-auth-webauthn
//!
//! The **WebAuthn / FIDO2 / passkey** (passwordless human login) relying party
//! of the shared edda auth family, in pure Rust (`p256`, no FFI, no C toolchain).
//! Two modules, each behind its own feature:
//!
//! * [`pure`] (`webauthn-pure`, the default) — the RP-side ceremony checks, the
//! MAC'd session token a verified ceremony mints, and the
//! `pure::PurePasskeyProvider` on the shared `nornir_service::AuthProvider`
//! seam. Holger links it.
//! * `ceremony` (off by default) — the server side of a ceremony over relayed
//! fields: the per-client challenge store, the relying-party and origin rules,
//! the assertion and attestation checks. Gunnar and `nornir-identity` link it.
//!
//! Both keep the ceremony state on the server and hand the verified result
//! (with the signature counter) back to the caller to store.
//!
//! The `webauthn-rs`-backed provider that used to sit beside them (feature
//! `webauthn`) is gone (A34-32): its serialisable state carried the subject, so
//! whoever held the state chose who signed in, and it dropped the
//! `AuthenticationResult`, so the counter was never stored. It also linked
//! OpenSSL, and nothing ever enabled it.
/// **The pure-Rust backend** — `p256` + `ciborium`, no FFI. The default, and the
/// one an airgapped appliance links. See the module docs for the measured cost
/// comparison against `webauthn-rs` and for what it deliberately does not do.
#[cfg(feature = "webauthn-pure")]
pub mod pure;
/// The ES256 checks `pure` and `ceremony` share: one copy.
#[cfg(any(feature = "webauthn-pure", feature = "ceremony"))]
mod es256;
/// **Who a caller is, as a key** (feature `client-key`, no dependencies): the one partition
/// rule, IPv4 by address, IPv6 by its /64 (RA5-34).
#[cfg(feature = "client-key")]
pub mod client_key;
/// **The server side of a ceremony over relayed fields** (feature `ceremony`,
/// off by default): the per-client challenge store, the relying-party rules and
/// the assertion/attestation checks. See the module docs.
#[cfg(feature = "ceremony")]
pub mod ceremony;
/// A **soft authenticator** for tests — a passkey in software, so a consumer can
/// drive a real register -> login round trip against its own running server.
/// Behind `test-support`; never in a shipped closure.
#[cfg(feature = "test-support")]
pub mod softkey;