agent_workspace_contract/environment/
application_execution.rs

1//! Resource-manager authorization for a bounded cross-tenant application execution.
2use super::*;
3
4pub const APPLICATION_EXECUTIONS_PATH: &str =
5    "/internal/v1/workspace/computers/{computerId}/application-executions";
6pub const APPLICATION_COMMAND_CONTEXTS_PATH: &str =
7    "/internal/v1/workspace/computers/{computerId}/application-command-contexts";
8pub const APPLICATION_EXECUTION_HEADER: &str = "x-workspace-application-execution";
9pub const APPLICATION_AGENT_HEADER: &str = "x-workspace-execution-agent";
10pub const APPLICATION_CALLER_HEADER: &str = "x-workspace-caller-authorization";
11pub const APPLICATION_EXECUTION_MAX_TTL_MS: u64 = 24 * 60 * 60 * 1000;
12
13#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
14#[serde(deny_unknown_fields, rename_all = "camelCase")]
15pub struct CreateApplicationExecutionRequest {
16    pub app_id: String,
17    pub space_id: String,
18    pub agent_id: String,
19    pub runtime_id: String,
20    pub ttl_ms: u64,
21}
22
23/// This handle is usable only by its verified Runtime for the selected Agent.
24#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
25#[serde(deny_unknown_fields, rename_all = "camelCase")]
26pub struct ApplicationExecutionResource {
27    pub id: String,
28    pub app_id: String,
29    pub computer_id: String,
30    pub space_id: String,
31    pub agent_id: String,
32    pub runtime_id: String,
33    pub grant_id: String,
34    pub grant_version: u64,
35    pub expires_at_ms: u64,
36}
37
38/// Internal authenticated context, never accepted from a JSON body or JWT claim.
39#[derive(Debug, Clone, Serialize, Deserialize)]
40pub struct VerifiedApplicationExecution {
41    #[serde(default)]
42    pub runtime_scope: Option<ResourceScope>,
43    pub resource: ApplicationExecutionResource,
44    pub scope: ResourceScope,
45    pub caller_user_id: String,
46}
47impl VerifiedApplicationExecution {
48    pub fn principal(&self) -> PrincipalRef {
49        PrincipalRef::agent(format!("application:{}", self.resource.id))
50    }
51}
agent_workspace_contract/environment/application_execution.rs

agent_workspace_contract/environment/
application_execution.rs
