Trust boundaries
Architecture
A deliberately small public service in front of one private, durable persistence engine.Why Rust
Rust gives the public authentication boundary memory safety without a garbage collector, predictable resource use, and a single deployable binary. Axum keeps the HTTP surface explicit and composable.
Why SableDB
SableDB is a Rust-native, Valkey-compatible persistence engine. RustyAuth uses atomic pipelines for multi-key identity operations and requires a private, volume-backed deployment. It is the only online durable store. See the identity data model for the complete aggregate, index and lifecycle contract.
Key lifecycle
RustyAuth prepublishes each replacement signing key, activates it after the JWKS cache window, and retains the retired public key until every old access token has expired. The private key is encrypted in SableDB and can be transparently rewrapped during master-key rotation.
Recovery boundary
A consistent mutation gate produces sorted logical snapshots with a tenant-bound manifest. RustyAuth compresses and authenticates each snapshot with AES-256-GCM, verifies it after upload, and only restores into an empty target. Interrupted recovery blocks normal startup instead of serving partial identity state.
Typed service contracts
Versioned Protobuf services provide trusted identity reads, exact search, controlled mutations and durable event streaming over Connect, gRPC-Web and gRPC. Browser WebAuthn remains HTTP-oriented, and the RPC projection excludes stored credential material.
Responsibility split
- RustyAuth proves identity and manages credentials, ceremonies, sessions, signing keys and authentication claims.
- Your application owns authorization, roles, entitlements and resource ownership.
- SableDB and backup storage are never exposed as public authentication interfaces.