aven_protocol/
bootstrap.rs

1//! Pure seed credential checks for bootstrap admission.
2use crate::claim::{Genesis, Secret};
3use anyhow::{Result, ensure};
4/// The credential does not authenticate current membership for staging.
5#[derive(Debug)]
6pub struct Unauthorized;
7
8impl std::fmt::Display for Unauthorized {
9    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
10        f.write_str("error bootstrap-unauthorized")
11    }
12}
13
14impl std::error::Error for Unauthorized {}
15
16#[derive(Debug)]
17pub struct Authentication<'a> {
18    pub vault_id: [u8; 32],
19    pub genesis_commitment: [u8; 32],
20    pub bearer: &'a Secret,
21}
22
23/// Seed authority is checked before any stored membership or outcome state.
24/// After publication the caller must also authenticate current membership.
25pub fn authenticate_seed(genesis: &Genesis, auth: &Authentication<'_>) -> Result<()> {
26    ensure!(
27        genesis.authorizes_bearer(auth.bearer)
28            && genesis.context().vault_id == auth.vault_id
29            && genesis.commitment() == auth.genesis_commitment,
30        Unauthorized
31    );
32    Ok(())
33}
aven_protocol/bootstrap.rs

aven_protocol/
bootstrap.rs
