refactor(core): rfc 0026 green b1 — token store moves to ourios-core

[jensholdgaard]

What

RFC 0026 green slice (b1) — a preparatory, behavior-preserving move: the token store relocates from ourios-server::auth to ourios_core::auth.

Why

Slice (b2) puts the ingest enforcement (RFC0026.2/.3, the §3.2 authn + tenant binding) where the listeners live: ourios-ingester's gRPC interceptor and HTTP middleware — which is also where the red stubs sit (crates/ourios-ingester/tests/rfc0026_auth.rs). The ingester cannot depend on ourios-server, so the shared types move down:

• TokenStore / ResolvedToken / TenantSet, the validation, and the constant-time authenticate (via subtle, dep moved server→core) now live in ourios_core::auth, behind a config-agnostic TokenSpec input shape.
• ourios-server::auth keeps the AuthSection → TokenSpec mapping and re-exports the types, so the single validation path (RFC 0020 §3.1) is unchanged — it just lives one crate lower.

No behavior change: the five store unit tests moved to core verbatim; the server side keeps a mapping-fidelity test plus all RFC0026.1 arms (schema, mapping, spawned-binary) exactly as merged in #390.

Invariants / hazards

• §3.7 multi-tenancy: no data-path change; this positions the types for the (b2) enforcement slice.
• Secret hygiene: the moved Debug redactions and name-only error surfaces carry their tests with them; TokenSpec gets the same redacting Debug as the schema type it mirrors.

Checks run locally

cargo fmt --all --check, cargo clippy -p ourios-core -p ourios-server --all-targets --all-features -- -D warnings, cargo test -p ourios-core -p ourios-server --all-features — all green.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@jensholdgaard, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 30889b08-af1f-47c9-a47e-ce1c8734e7f6

📥 Commits

Reviewing files that changed from the base of the PR and between a0cb122 and 16bf17b.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• crates/ourios-core/Cargo.toml
• crates/ourios-core/src/auth.rs
• crates/ourios-core/src/lib.rs
• crates/ourios-server/Cargo.toml
• crates/ourios-server/src/auth.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rfc0026-green-b1-core-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR refactors the RFC 0026 token-store implementation by relocating the resolved token store (types + validation + constant-time token comparison) from ourios-server into ourios-core, allowing future enforcement points (notably ourios-ingester) to consume the same logic without depending on the server crate.

Changes:

• Moved TokenStore/ResolvedToken/TenantSet + validation + authenticate into ourios_core::auth, introducing a config-agnostic TokenSpec input.
• Simplified ourios-server::auth to map AuthSection → TokenSpec, call core validation, and re-export the auth types.
• Shifted the subtle dependency from ourios-server to ourios-core and updated the lockfile accordingly.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/ourios-server/src/auth.rs	Becomes a thin mapping layer and re-export surface for core auth types.
crates/ourios-server/Cargo.toml	Removes direct subtle dependency (now owned by core).
crates/ourios-core/src/lib.rs	Exposes the new auth module publicly.
crates/ourios-core/src/auth.rs	New home for token store types, validation, redacted Debug, and constant-time comparison.
crates/ourios-core/Cargo.toml	Adds subtle dependency required by the moved implementation.
Cargo.lock	Reflects dependency movement (subtle now associated with ourios-core).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated no new comments.