canic_core/api/auth/
mod.rs

1//! Module: api::auth
2//!
3//! Responsibility: expose auth endpoint helpers and auth boundary adapters.
4//! Does not own: stable auth records, proof verification internals, or runtime policy.
5//! Boundary: endpoint layer maps public DTOs into ops/workflow auth calls.
6
7use crate::{dto::error::Error, ops::config::ConfigOps};
8
9// Internal auth pipeline:
10// - `application_session` owns managed scoped-session command/status adapters.
11// - `attestation` owns role-attestation endpoint adapters.
12// - `root` owns root-only issuer policy, renewal, and chain-key proof adapters.
13// - `token` owns issuer-local delegated-token endpoint adapters.
14mod application_session;
15mod attestation;
16mod root;
17mod token;
18
19///
20/// AuthApi
21///
22/// Owns delegated-token helpers and root-signed role-attestation helpers.
23/// Owned by the API layer and called by generated endpoint wrappers.
24///
25
26pub struct AuthApi;
27
28impl AuthApi {
29    // Map internal auth failures onto public endpoint errors.
30    fn map_auth_error(err: crate::InternalError) -> Error {
31        Error::from(err)
32    }
33
34    fn require_delegated_token_issuer_enabled() -> Result<(), Error> {
35        let delegated_tokens_cfg =
36            ConfigOps::delegated_tokens_config().map_err(Self::map_auth_error)?;
37        if !delegated_tokens_cfg.enabled {
38            return Err(Error::from_registered(
39                crate::diagnostics::codes::REQUEST_INVALID,
40            ));
41        }
42
43        let canister_cfg = ConfigOps::current_canister().map_err(Self::map_auth_error)?;
44        if !canister_cfg.auth.delegated_token_issuer {
45            return Err(Error::from_registered(
46                crate::diagnostics::codes::AUTHORITY_UNAUTHORIZED,
47            ));
48        }
49
50        Ok(())
51    }
52}
canic_core/api/auth/mod.rs

canic_core/api/auth/
mod.rs
