authkestra_devsig/request.rs
1//! The inbound-request facts `verify()` needs, decoupled from any HTTP framework.
2//!
3//! This is deliberately not an axum/tower type. The verification core in [`crate::verify`] takes
4//! this plain struct so it can be called from a `tower::Layer`, a future authkestra
5//! trait-based integration, a CLI test harness, or anything else that can produce these seven
6//! fields — the integration surface is free to change without touching the algorithm.
7
8/// The two credential headers plus the request facts needed to check request binding.
9pub struct SignedRequest<'a> {
10 /// Compact JWS from `X-Signature`.
11 pub signature: Option<&'a str>,
12 /// Compact JWS from `X-Attestation`.
13 pub attestation: Option<&'a str>,
14 /// Uppercase HTTP method, e.g. `"POST"`.
15 pub method: &'a str,
16 /// Request path, percent-encoded, excluding the query string.
17 pub path: &'a str,
18 /// Raw query string (no leading `?`), if the request has one.
19 pub query: Option<&'a str>,
20 /// Raw request body bytes, if the request has a body.
21 pub body: Option<&'a [u8]>,
22}