aven_protocol/wire/
enrollment.rs

1//! Enrollment transport. Verified evidence and active client inputs stay with their owner.
2use crate::claim::Secret;
3use serde::{Deserialize, Serialize};
4/// Explicit current-head request context. Historical outcomes cannot authenticate it.
5pub struct Authentication<'a> {
6    pub vault: [u8; 32],
7    pub genesis: [u8; 32],
8    pub device: [u8; 32],
9    pub head: [u8; 32],
10    pub bearer: &'a Secret,
11}
12
13#[derive(Serialize, Deserialize)]
14#[serde(deny_unknown_fields)]
15pub enum Operation {
16    Register {
17        context: Context,
18        #[serde(with = "crate::base64_bytes")]
19        declaration: Vec<u8>,
20    },
21    Post {
22        vault: [u8; 32],
23        handle: [u8; 32],
24        #[serde(with = "crate::base64_bytes")]
25        request: Vec<u8>,
26    },
27    Mailbox {
28        vault: [u8; 32],
29        handle: [u8; 32],
30    },
31    Admit {
32        context: Context,
33        handle: [u8; 32],
34        #[serde(with = "crate::base64_bytes")]
35        record: Vec<u8>,
36    },
37    Membership {
38        context: Context,
39    },
40    PrepareManagement {
41        context: Context,
42    },
43    Manage {
44        context: Context,
45        #[serde(with = "crate::base64_bytes")]
46        record: Vec<u8>,
47    },
48    Cancel {
49        context: Context,
50        handle: [u8; 32],
51    },
52    Published {
53        context: Context,
54        descriptor: [u8; 32],
55        component: Option<super::bootstrap::Component>,
56        index: u64,
57    },
58}
59#[derive(Serialize, Deserialize)]
60#[serde(deny_unknown_fields)]
61pub enum Reply<Evidence, Mailbox, ManagementPreparation> {
62    Done,
63    Registered(RegistrationStatus),
64    Mailbox(Mailbox),
65    Admitted(#[serde(with = "crate::base64_bytes")] Vec<u8>),
66    Membership(Evidence),
67    PreparedManagement(ManagementPreparation),
68    Managed(#[serde(with = "crate::base64_bytes")] Vec<u8>),
69    Cancelled(CancelStatus),
70    Published(#[serde(with = "crate::base64_bytes")] Vec<u8>),
71}
72
73#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
74pub enum RegistrationStatus {
75    Open,
76    Expired,
77    Consumed,
78}
79
80/// Serialized outcome of cancelling a registered invitation. `Admitted` is a
81/// hint only; callers resolve admission from the verified membership chain.
82#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
83pub enum CancelStatus {
84    Admitted,
85    Cancelled,
86}
87
88pub const MAX_RECORD_BYTES: usize = 32768;
89pub const PATH: &str = "/e2ee/enrollment/v1";
90pub const CONTROL_LIMIT: usize = crate::base64_bytes::encoded_len(MAX_RECORD_BYTES) + 4096;
91pub const PUBLISHED_RESPONSE_LIMIT: usize =
92    crate::base64_bytes::encoded_len(super::bootstrap::MAX_REQUEST_BYTES) + 4096;
93
94#[derive(Clone, Serialize, Deserialize)]
95#[serde(deny_unknown_fields)]
96pub struct Context {
97    pub vault: [u8; 32],
98    pub genesis: [u8; 32],
99    pub device: [u8; 32],
100    pub head: [u8; 32],
101}
102impl Context {
103    /// Converts active client inputs without coupling the wire format to their storage.
104    pub fn active<'a, T>(inputs: &'a T) -> Self
105    where
106        &'a T: Into<Self>,
107    {
108        inputs.into()
109    }
110    pub fn auth<'a>(&self, bearer: &'a Secret) -> Authentication<'a> {
111        Authentication {
112            vault: self.vault,
113            genesis: self.genesis,
114            device: self.device,
115            head: self.head,
116            bearer,
117        }
118    }
119}
aven_protocol/wire/enrollment.rs

aven_protocol/wire/
enrollment.rs
