canic_core/api/auth/
attestation.rs

1//! Module: api::auth::attestation
2//!
3//! Responsibility: adapt role-attestation endpoint calls.
4//! Does not own: role-attestation signing, cache state, or verifier internals.
5//! Boundary: endpoint adapters delegate role-attestation work to workflow.
6
7use super::AuthApi;
8use crate::{
9    dto::{
10        auth::{
11            RoleAttestationGetRequest, RoleAttestationPrepareResponse, RoleAttestationRequest,
12            SignedRoleAttestation,
13        },
14        error::Error,
15    },
16    workflow::runtime::auth::RuntimeAuthWorkflow,
17};
18
19impl AuthApi {
20    /// Prepare a root-certified role attestation from the local root update path.
21    pub fn prepare_component_role_attestation_root(
22        request: RoleAttestationRequest,
23        component: &crate::ids::ComponentBinding,
24    ) -> Result<RoleAttestationPrepareResponse, Error> {
25        RuntimeAuthWorkflow::prepare_component_role_attestation_root(request, component)
26            .map_err(Self::map_auth_error)
27    }
28
29    /// Retrieve a prepared role attestation with its root canister-signature proof.
30    pub fn get_role_attestation_root(
31        request: RoleAttestationGetRequest,
32    ) -> Result<SignedRoleAttestation, Error> {
33        RuntimeAuthWorkflow::get_role_attestation_root(request).map_err(Self::map_auth_error)
34    }
35
36    /// Verify a role attestation locally from its embedded root proof.
37    pub async fn verify_role_attestation(
38        attestation: &SignedRoleAttestation,
39        min_accepted_epoch: u64,
40    ) -> Result<(), Error> {
41        RuntimeAuthWorkflow::verify_role_attestation(attestation, min_accepted_epoch)
42            .await
43            .map_err(Self::map_auth_error)
44    }
45}
canic_core/api/auth/attestation.rs

canic_core/api/auth/
attestation.rs
