auths_core/trust/
policy.rs

1//! Trust policy definitions for identity verification.
2
3/// How the verifier decides to trust a root key.
4#[derive(Debug, Clone, Default, PartialEq, Eq)]
5pub enum TrustPolicy {
6    /// Accept on first use, pin for future. Interactive prompt on conflict.
7    ///
8    /// This is the default for interactive local development. When an unknown
9    /// identity is encountered, the user is prompted to trust it. Once trusted,
10    /// the identity is pinned for future verification.
11    #[default]
12    Tofu,
13
14    /// Require an explicit pin, roots file, or --issuer-pk. No interactive prompts.
15    ///
16    /// This is the default for non-interactive environments (CI pipelines).
17    /// Fails closed if the identity is unknown, ensuring CI never hangs waiting
18    /// for interactive input.
19    Explicit,
20}
21
22impl TrustPolicy {
23    /// Parse a trust policy from a command-line flag value.
24    ///
25    /// # Examples
26    ///
27    /// ```
28    /// use auths_core::trust::TrustPolicy;
29    ///
30    /// assert_eq!(TrustPolicy::from_str_flag("tofu"), Ok(TrustPolicy::Tofu));
31    /// assert_eq!(TrustPolicy::from_str_flag("explicit"), Ok(TrustPolicy::Explicit));
32    /// assert!(TrustPolicy::from_str_flag("invalid").is_err());
33    /// ```
34    pub fn from_str_flag(s: &str) -> Result<Self, String> {
35        match s {
36            "tofu" => Ok(Self::Tofu),
37            "explicit" => Ok(Self::Explicit),
38            other => Err(format!(
39                "Unknown trust policy: '{}'. Valid values: tofu, explicit",
40                other
41            )),
42        }
43    }
44}
45
46#[cfg(test)]
47mod tests {
48    use super::*;
49
50    #[test]
51    fn test_from_str_flag_tofu() {
52        assert_eq!(TrustPolicy::from_str_flag("tofu"), Ok(TrustPolicy::Tofu));
53    }
54
55    #[test]
56    fn test_from_str_flag_explicit() {
57        assert_eq!(
58            TrustPolicy::from_str_flag("explicit"),
59            Ok(TrustPolicy::Explicit)
60        );
61    }
62
63    #[test]
64    fn test_from_str_flag_invalid() {
65        let result = TrustPolicy::from_str_flag("invalid");
66        assert!(result.is_err());
67        assert!(result.unwrap_err().contains("Unknown trust policy"));
68    }
69
70    #[test]
71    fn test_default() {
72        assert_eq!(TrustPolicy::default(), TrustPolicy::Tofu);
73    }
74}
auths_core/trust/policy.rs

auths_core/trust/
policy.rs
