//! Authentication module for API Gateway
//!
//! Provides comprehensive 6-layer authentication for all incoming gRPC requests:
//! 1. mTLS client certificate validation (tonic-tls)
//! 2. JWT extraction from Authorization header
//! 3. JWT revocation check (Redis-backed)
//! 4. JWT signature and expiration validation
//! 5. RBAC permission check (cached)
//! 6. Rate limiting (in-memory atomic counters)
//! 7. User context injection (gRPC metadata)
//! 8. Async audit logging (non-blocking)
//!
//! Performance targets:
//! - Total overhead: <10μs per request
//! - JWT validation: <1μs (cached decoding key)
//! - Revocation check: <500ns (Redis in same AZ)
//! - Authorization: <100ns (in-memory cache)
//! - Rate limiting: <50ns (atomic counters)

pub mod grpc_login;
pub mod interceptor;
pub mod jwt;
#[cfg(feature = "mfa")]
pub mod mfa;
pub mod mtls;

// Re-export core authentication types
pub use interceptor::{
    AuditLogger, AuthInterceptor, AuthzService, CacheStats, Jti, JwtClaims, JwtService,
    RateLimiter, RevocationService, UserContext,
};

// Re-export mTLS types
pub use mtls::{ApiGatewayTlsConfig, TlsInterceptor, TlsProtocolVersion};