feature: Adds the zeroize feature to project crates

Signed-off-by: Nick Gerakines <[e-mail]>

CLAUDE.md

···
 #### Identity Management
 - **Resolve identities**: `cargo run --features clap --bin atproto-identity-resolve -- <handle_or_did>`
 - **Resolve with DID document**: `cargo run --features clap --bin atproto-identity-resolve -- --did-document <handle_or_did>`
-- **Generate keys**: `cargo run --features clap --bin atproto-identity-key -- generate p256`
+- **Generate keys**: `cargo run --features clap --bin atproto-identity-key -- generate p256` (supports p256, p384, k256)
 - **Sign data**: `cargo run --features clap --bin atproto-identity-sign -- <did_key> <json_file>`
 - **Validate signatures**: `cargo run --features clap --bin atproto-identity-validate -- <did_key> <json_file> <signature>`
 
···
 ## Architecture
 
 A comprehensive Rust workspace with multiple crates:
-- **atproto-identity**: Core identity management with 8 modules (resolve, plc, web, model, validation, config, errors, key)
+- **atproto-identity**: Core identity management with 11 modules (resolve, plc, web, model, validation, config, errors, key, storage, storage_lru, axum)
 - **atproto-record**: Record signature operations and validation  
 - **atproto-client**: HTTP client with OAuth and identity integration
 - **atproto-jetstream**: WebSocket event streaming with compression
-- **atproto-oauth**: OAuth workflow implementation with storage
+- **atproto-oauth**: OAuth workflow implementation with DPoP, PKCE, JWT, and storage abstractions
+- **atproto-oauth-aip**: AT Protocol OAuth AIP (Identity Provider) implementation with PAR support
 - **atproto-oauth-axum**: Axum web framework integration for OAuth
 - **atproto-xrpcs**: XRPC service framework
 - **atproto-xrpcs-helloworld**: Complete example XRPC service
···
 - **Comprehensive error handling** with structured error types
 - **Full test coverage** with unit tests across all modules
 - **Modern dependencies** for HTTP, DNS, JSON, cryptographic operations, and WebSocket streaming
+- **Storage abstractions** with LRU caching support (optional via `lru` feature)
+- **Axum integration** for web framework support (optional via `axum` feature)
+- **Secure memory handling** (optional via `zeroize` feature)
 
 ## Error Handling
 
···
 - **`src/validation.rs`**: Input validation for handles and DIDs
 - **`src/config.rs`**: Configuration management and environment variable handling
 - **`src/errors.rs`**: Structured error types following project conventions
-- **`src/key.rs`**: Cryptographic key operations including signature validation and key identification for P-256 and K-256 curves
+- **`src/key.rs`**: Cryptographic key operations including signature validation and key identification for P-256, P-384, and K-256 curves
+- **`src/storage.rs`**: Storage abstraction interface for DID document caching
+- **`src/storage_lru.rs`**: LRU-based storage implementation (requires `lru` feature)
+- **`src/axum.rs`**: Axum web framework integration (requires `axum` feature)
 
 ### CLI Tools (require --features clap)
 
 #### Identity Management (atproto-identity)
 - **`src/bin/atproto-identity-resolve.rs`**: Resolve AT Protocol handles and DIDs to canonical identifiers
-- **`src/bin/atproto-identity-key.rs`**: Generate and manage cryptographic keys (P-256, K-256)
+- **`src/bin/atproto-identity-key.rs`**: Generate and manage cryptographic keys (P-256, P-384, K-256)
 - **`src/bin/atproto-identity-sign.rs`**: Create cryptographic signatures of JSON data
 - **`src/bin/atproto-identity-validate.rs`**: Validate cryptographic signatures
 

Cargo.lock

···
  "thiserror 2.0.12",
  "tokio",
  "tracing",
+ "zeroize",
 ]
 
 [[package]]
···
  "tokio",
  "tracing",
  "ulid",
+ "zeroize",
 ]
 
 [[package]]
···
  "serde",
  "serde_json",
  "thiserror 2.0.12",
+ "zeroize",
 ]
 
 [[package]]
···
  "tokio",
  "tracing",
  "urlencoding",
+ "zeroize",
 ]
 
 [[package]]
···
 version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
 
 [[package]]
 name = "zerotrie"

Cargo.toml

···
 urlencoding = "2.1"
 zstd = "0.13"
 
+zeroize = { version = "1.8.1", features = ["zeroize_derive"] }
+
 [workspace.lints.rust]
 unsafe_code = "forbid"

Dockerfile

···
 # - atproto-oauth-axum: 1 binary (oauth-tool)
 # - atproto-xrpcs-helloworld: 1 binary (xrpcs-helloworld)
 # - atproto-jetstream: 1 binary (jetstream-consumer)
-RUN cargo build --release --bins -F clap
+RUN cargo build --release --bins -F clap,zeroize
 
 # Runtime stage - use distroless for minimal attack surface
 FROM gcr.io/distroless/cc-debian12

crates/atproto-identity/Cargo.toml

···
 axum = { version = "0.8", optional = true, features = ["macros"] }
 http = { version = "1.0.0", optional = true }
 
+zeroize = { workspace = true, optional = true }
+
 [features]
 default = ["lru", "axum"]
 lru = ["dep:lru"]
 axum = ["dep:axum", "dep:http"]
 clap = ["dep:clap"]
+zeroize = ["dep:zeroize"]
 
 [lints]
 workspace = true

crates/atproto-identity/src/key.rs

···
 
 use crate::errors::KeyError;
 
+#[cfg(feature = "zeroize")]
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
 /// Cryptographic key types supported for AT Protocol identity.
+#[derive(Clone, PartialEq)]
 #[cfg_attr(debug_assertions, derive(Debug))]
-#[derive(Clone, PartialEq)]
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 pub enum KeyType {
     /// A p256 (P-256 / secp256r1 / ES256) public key.
     /// The multibase / multicodec prefix is 8024.
···
 /// * `private_dpop_key_data`
 ///
 #[derive(Clone)]
+#[cfg_attr(feature = "zeroize", derive(zeroize::Zeroize, zeroize::ZeroizeOnDrop))]
 pub struct KeyData(pub KeyType, pub Vec<u8>);
 
 impl KeyData {
···
 
     /// Consumes self and returns the key type and bytes as a tuple.
     pub fn into_parts(self) -> (KeyType, Vec<u8>) {
-        (self.0, self.1)
+        (self.0.clone(), self.1.clone())
     }
 }
 

crates/atproto-oauth-aip/Cargo.toml

···
 serde.workspace = true
 thiserror.workspace = true
 
+zeroize = { workspace = true, optional = true }
+
+[features]
+zeroize = ["dep:zeroize", "atproto-oauth/zeroize"]
+
 [lints]
 workspace = true

crates/atproto-oauth-aip/src/workflow.rs

···
 //! for each phase of the OAuth flow including network failures, parsing errors,
 //! and protocol violations.
 
-use crate::errors::OAuthWorkflowError;
 use anyhow::Result;
 use atproto_oauth::{
     resources::{AuthorizationServer, OAuthProtectedResource},
···
 };
 use serde::Deserialize;
 
+use crate::errors::OAuthWorkflowError;
+
+#[cfg(feature = "zeroize")]
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
 /// OAuth client configuration containing essential client credentials.
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 pub struct OAuthClient {
     /// The redirect URI where the authorization server will send the user after authorization.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub redirect_uri: String,
+
     /// The unique client identifier for this OAuth client.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub client_id: String,
 
     /// The client secret used for authenticating with the authorization server.
···
 /// This structure contains all the information needed to make authenticated
 /// requests to AT Protocol services after a successful OAuth flow.
 #[derive(Clone, Deserialize)]
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 pub struct ATProtocolSession {
     /// The Decentralized Identifier (DID) of the authenticated user.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub did: String,
+
     /// The handle (username) of the authenticated user.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub handle: String,
+
     /// The OAuth access token for making authenticated requests.
     pub access_token: String,
+
     /// The type of token (typically "Bearer").
     pub token_type: String,
+
     /// The list of OAuth scopes granted to this session.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub scopes: Vec<String>,
+
     /// The Personal Data Server (PDS) endpoint URL for this user.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub pds_endpoint: String,
+
     /// The DPoP (Demonstration of Proof-of-Possession) key in JWK format.
     pub dpop_key: String,
+
     /// Unix timestamp indicating when this session expires.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub expires_at: i64,
 }
 
 #[derive(Deserialize, Clone)]
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 #[serde(untagged)]
 enum WrappedATProtocolSession {
     ATProtocolSession(ATProtocolSession),
+
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     Error {
         error: String,
         error_description: Option<String>,
···
         .map_err(OAuthWorkflowError::SessionResponseParseFailed)?;
 
     match response {
-        WrappedATProtocolSession::ATProtocolSession(value) => Ok(value),
+        WrappedATProtocolSession::ATProtocolSession(ref value) => Ok(value.clone()),
         WrappedATProtocolSession::Error {
-            error,
-            error_description,
+            ref error,
+            ref error_description,
         } => {
             let error_message = if let Some(value) = error_description {
                 format!("{error}: {value}")

crates/atproto-oauth-axum/Cargo.toml

···
 rpassword = { workspace = true, optional = true }
 secrecy = { workspace = true, optional = true }
 
+zeroize = { workspace = true, optional = true }
+
 [features]
 clap = ["dep:clap", "dep:rpassword", "dep:secrecy"]
+zeroize = ["dep:zeroize", "atproto-identity/zeroize", "atproto-oauth/zeroize"]
 
 [lints]
 workspace = true

crates/atproto-oauth-axum/src/bin/atproto-oauth-tool.rs

···
             .iter()
             .filter_map(|value| to_public(value).ok())
             .collect(),
+        scope: None,
         client_name: None,
         client_uri: None,
         logo_uri: None,

crates/atproto-oauth-axum/src/handle_complete.rs

···
     let private_dpop_key_data = identify_key(&oauth_request.dpop_private_key)?;
 
     let oauth_client = OAuthClient {
-        redirect_uri: oauth_client_config.redirect_uris,
-        client_id: oauth_client_config.client_id,
+        redirect_uri: oauth_client_config.redirect_uris.clone(),
+        client_id: oauth_client_config.client_id.clone(),
         private_signing_key_data,
     };
 
···
         token_response.token_type,
         token_response.expires_in,
         token_response.scope,
-        token_response.sub.unwrap_or("unknown".to_string()),
+        token_response.sub.clone().unwrap_or("unknown".to_string()),
         private_dpop_key_data
     );
 

crates/atproto-oauth-axum/src/handle_init.rs

···
-//! OAuth authorization initiation handler (placeholder).
-//!
-//! Reserved module for OAuth authorization initiation endpoints.
-//! Currently unused but available for future implementation.

crates/atproto-oauth-axum/src/lib.rs

···
 
 pub mod errors;
 pub mod handle_complete;
-pub mod handle_init;
 pub mod handle_jwks;
 pub mod handler_metadata;
 pub mod state;

crates/atproto-oauth-axum/src/state.rs

···
 use http::request::Parts;
 use std::convert::Infallible;
 
+#[cfg(feature = "zeroize")]
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
 /// OAuth client configuration for Axum handlers.
 ///
 /// Contains the essential configuration needed for OAuth client operations.
 #[derive(Clone, Default)]
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 pub struct OAuthClientConfig {
     /// OAuth client identifier
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub client_id: String,
+
     /// Allowed OAuth redirect URIs
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub redirect_uris: String,
+
     /// JSON Web Key Set URI for public keys
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub jwks_uri: Option<String>,
+
     /// Signing keys for JWT operations
     pub signing_keys: Vec<KeyData>,
+
     /// OAuth scope, defaults to "atproto transition:generic"
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub scope: Option<String>,
 
     /// Optional human-readable client name
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub client_name: Option<String>,
+
     /// Optional client website URI
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub client_uri: Option<String>,
+
     /// Optional client logo URI
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub logo_uri: Option<String>,
+
     /// Optional terms of service URI
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub tos_uri: Option<String>,
+
     /// Optional privacy policy URI
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub policy_uri: Option<String>,
 }
 

crates/atproto-oauth/Cargo.toml

···
 axum = { version = "0.8", optional = true }
 http = { version = "1.0.0", optional = true }
 
+zeroize = { workspace = true, optional = true }
+
 [features]
 default = ["lru", "axum"]
 lru = ["dep:lru"]
 axum = ["dep:axum", "dep:http"]
+zeroize = ["dep:zeroize", "atproto-identity/zeroize"]
 
 [lints]
 workspace = true

crates/atproto-oauth/src/dpop.rs

···
         type_: Some("dpop+jwt".to_string()),
         algorithm: Some("ES256".to_string()),
         json_web_key: Some(dpop_jwk),
-        ..Default::default()
+        key_id: None,
     };
 
     let auth = access_token.map(challenge);
···
             type_: Some("dpop+jwt".to_string()),
             algorithm: Some("ES256".to_string()),
             json_web_key: Some(dpop_jwk),
-            ..Default::default()
+            key_id: None,
         };
 
         let claims = Claims::new(JoseClaims {

crates/atproto-oauth/src/jwk.rs

···
 
 use crate::errors::JWKError;
 
+#[cfg(feature = "zeroize")]
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
 /// A wrapped JSON Web Key with additional metadata.
+#[derive(Serialize, Deserialize, Clone, PartialEq)]
 #[cfg_attr(debug_assertions, derive(Debug))]
-#[derive(Serialize, Deserialize, Clone, PartialEq)]
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 pub struct WrappedJsonWebKey {
     /// Key identifier (kid) for the JWK.
     #[serde(skip_serializing_if = "Option::is_none", default)]
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub kid: Option<String>,
 
     /// Algorithm (alg) used with this key.
     #[serde(skip_serializing_if = "Option::is_none", default)]
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub alg: Option<String>,
 
     /// Public key use (use) parameter, typically "sig" for signature operations.
     #[serde(rename = "use", skip_serializing_if = "Option::is_none")]
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub _use: Option<String>,
 
     /// The underlying elliptic curve JWK.

crates/atproto-oauth/src/jwt.rs

···
 //! custom extensions for AT Protocol OAuth flows. Supports ES256, ES384, and ES256K elliptic curve
 //! signature algorithms with comprehensive timestamp validation and structured error handling.
 
-use crate::encoding::ToBase64;
-use crate::errors::JWTError;
 use anyhow::Result;
 use atproto_identity::key::{KeyData, KeyType, sign, to_public, validate};
 use base64::{Engine as _, engine::general_purpose};
···
 use std::collections::BTreeMap;
 use std::time::{SystemTime, UNIX_EPOCH};
 
+use crate::encoding::ToBase64;
+use crate::errors::JWTError;
+
+#[cfg(feature = "zeroize")]
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
 /// JWT header containing algorithm and key metadata.
+#[derive(Clone, Default, PartialEq, Serialize, Deserialize)]
 #[cfg_attr(debug_assertions, derive(Debug))]
-#[derive(Clone, Default, PartialEq, Serialize, Deserialize)]
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 pub struct Header {
     /// Algorithm used for signing (e.g., "ES256", "ES384", "ES256K").
     #[serde(rename = "alg", skip_serializing_if = "Option::is_none")]
···
         (Some("ES384"), KeyType::P384Private) | (Some("ES384"), KeyType::P384Public) => {}
         _ => {
             return Err(JWTError::UnsupportedAlgorithm {
-                algorithm: header.algorithm.unwrap_or_else(|| "none".to_string()),
+                algorithm: header
+                    .algorithm
+                    .clone()
+                    .unwrap_or_else(|| "none".to_string()),
                 key_type: format!("{}", key_data.key_type()),
             }
             .into());

crates/atproto-oauth/src/workflow.rs

···
 //! ).await?;
 //! ```
 
-use crate::{
-    dpop::{DpopRetry, auth_dpop},
-    errors::OAuthClientError,
-    jwt::{Claims, Header, JoseClaims, mint},
-    resources::{AuthorizationServer, pds_resources},
-};
 use atproto_identity::key::KeyData;
 use chrono::{DateTime, Utc};
 use rand::distributions::{Alphanumeric, DistString};
 use reqwest_chain::ChainMiddleware;
 use reqwest_middleware::ClientBuilder;
-
+use serde::Deserialize;
 use std::collections::HashMap;
 
-use serde::Deserialize;
+#[cfg(feature = "zeroize")]
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+use crate::{
+    dpop::{DpopRetry, auth_dpop},
+    errors::OAuthClientError,
+    jwt::{Claims, Header, JoseClaims, mint},
+    resources::{AuthorizationServer, pds_resources},
+};
 
 /// Response from a Pushed Authorization Request (PAR) endpoint.
 ///
···
 ///
 /// This struct holds the client configuration needed for OAuth authorization flows,
 /// including the redirect URI, client identifier, and signing key.
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 pub struct OAuthClient {
     /// The redirect URI where the authorization server will send the user after authorization.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub redirect_uri: String,
+
     /// The unique client identifier for this OAuth client.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub client_id: String,
+
     /// The private key data used for signing client assertions.
     pub private_signing_key_data: KeyData,
 }
···
 /// This struct contains all the necessary information to track and complete
 /// an OAuth authorization request, including security parameters and timing.
 #[derive(Clone, PartialEq)]
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 pub struct OAuthRequest {
     /// The OAuth state parameter used to prevent CSRF attacks.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub oauth_state: String,
+
     /// The authorization server issuer identifier.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub issuer: String,
+
     /// The DID (Decentralized Identifier) of the user.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub did: String,
+
     /// The nonce value for additional security.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub nonce: String,
+
     /// The PKCE code verifier for this authorization request.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub pkce_verifier: String,
+
     /// The public key used for signing (serialized).
     pub signing_public_key: String,
+
     /// The DPoP private key (serialized).
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub dpop_private_key: String,
+
     /// When this OAuth request was created.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub created_at: DateTime<Utc>,
+
     /// When this OAuth request expires.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub expires_at: DateTime<Utc>,
 }
 
···
 /// This struct represents the successful response from an OAuth token exchange,
 /// containing the access token and related metadata.
 #[derive(Clone, Deserialize)]
+#[cfg_attr(feature = "zeroize", derive(Zeroize, ZeroizeOnDrop))]
 pub struct TokenResponse {
     /// The access token that can be used to access protected resources.
     pub access_token: String,
+
     /// The type of token, typically "Bearer" or "DPoP".
     pub token_type: String,
+
     /// The refresh token that can be used to obtain new access tokens.
     pub refresh_token: String,
+
     /// The scope of access granted by the access token.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub scope: String,
+
     /// The lifetime of the access token in seconds.
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub expires_in: u32,
+
     /// The subject identifier (usually the user's DID).
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub sub: Option<String>,
 
     /// Additional fields returned by the authorization server.
     #[serde(flatten)]
+    #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub extra: HashMap<String, serde_json::Value>,
 }