Struct SecurityContext 

pub struct SecurityContext { /* private fields */ }

A context for performing security operations.

Implementations

impl SecurityContext

pub fn new(key: AuthKey) -> Self

Creates a new security context with the given key and default settings.

pub fn for_testing(seed: u64) -> Self

Creates a security context for testing with a deterministic seed.

pub fn from_config(key: AuthKey, mode: AuthMode) -> Self

br-asupersync-x7ad3b: constructs a context at a deployment-configured AuthMode, selected at CONSTRUCTION time.

This is the sanctioned production path for building a non-Strict context: Self::with_mode deliberately panics on downgrades because a runtime transition to a looser mode is almost always a bug, but a deployment that declares auth_mode in its crate::config::SecurityConfig is making an explicit, audited mode choice up front (see the module doc on with_mode). crate::config::SecurityConfig::build_context is the only intended caller; it threads the operator’s configured mode and key seed into the live decode path so the RAPTORQ_SECURITY_AUTH_MODE / RAPTORQ_SECURITY_AUTH_KEY_SEED knobs actually take effect instead of being parsed-and-ignored phantom controls.

pub fn with_mode(self, mode: AuthMode) -> Self

Sets the authentication mode.

br-asupersync-jgpcvp: NO-DOWNGRADE policy

with_mode only allows transitions to a mode that is at least as strict as the current mode. Strictness order is Strict > Permissive > Disabled, so the allowed transitions are:

• Strict → Strict (no-op)
• Permissive → Strict / Permissive
• Disabled → Strict / Permissive / Disabled

Downgrades (Strict → Permissive, Strict → Disabled, Permissive → Disabled) are REJECTED by panicking with a security-sensitive message. Pre-fix, any caller could flip a strict context to Permissive at any time, silently bypassing authentication for every subsequent symbol verification.

Tests that need to verify Permissive / Disabled behavior must construct via [Self::for_testing_with_mode] instead.

Panics

Panics if mode is less strict than the current mode. The panic message identifies the attempted downgrade for diagnosis. This is a security-sensitive operation; silent-ignore would leave the caller believing the downgrade succeeded.

pub const fn mode(&self) -> AuthMode

Returns the authentication enforcement mode.

pub fn sign_symbol(&self, symbol: &Symbol) -> AuthenticatedSymbol

Signs a symbol, producing an authenticated symbol.

pub fn sign_symbol_tag(&self, symbol: &Symbol) -> AuthenticationTag

Computes the authentication tag for a symbol without cloning the symbol.

Hot transport paths use this when they only need to append the tag bytes to an existing wire envelope.

pub fn verify_authenticated_symbol( &self, auth: &mut AuthenticatedSymbol, ) -> Result<(), AuthError>

Verifies an authenticated symbol.

The behavior depends on the configured AuthMode:

• Strict: Returns Err on failure.
• Permissive: Returns Ok on failure (but verified flag remains false).
• Disabled: Returns Ok without checking and leaves the current verified flag intact.

If verification runs, the verified flag is updated to match the current result.

pub fn derive_context(&self, purpose: &[u8]) -> Self

Derives a child context with a subkey.

pub fn stats(&self) -> &AuthStats

Returns the authentication stats.

pub fn authorize_replica( &self, replica_id: &str, region_id: Option<&str>, ) -> Result<ReplicaAuthorization, AuthError>

Authorizes a replica in this context’s signed membership registry.

Errors

Returns AuthErrorKind::MalformedPayload when the replica or region identifier is not a stable wire-safe identifier.

pub fn import_replica_authorization( &self, record: ReplicaAuthorization, ) -> Result<(), AuthError>

Imports an externally-stored signed replica authorization receipt.

Errors

Returns AuthErrorKind::InvalidTag if the record signature does not verify against this context’s key.

pub fn revoke_replica_authorization(&self, replica_id: &str) -> bool

Revokes a replica authorization from the in-memory registry.

pub fn is_replica_authorized( &self, replica_id: &str, region_id: Option<&str>, ) -> bool

Validates whether a replica is authorized to participate in symbol assignment.

asupersync-j18rga: Checks replica credentials against the security context. This prevents unauthorized replicas from joining symbol distribution.

Arguments

• replica_id - The replica identifier to validate
• region_id - Optional region context for scoped authorization

Returns

true if the replica is authorized, false otherwise.

Trait Implementations

impl Clone for SecurityContext

fn clone(&self) -> SecurityContext

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityContext

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.