canic_core/api/
role.rs

1//! Module: api::role
2//!
3//! Responsibility: adapt the compiled role contract into immutable status verification.
4//! Does not own: capability derivation, endpoint emission, authorization, or mutable state.
5//! Boundary: maps internal capability keys to the closed public role overview values.
6
7use crate::{
8    dto::{
9        metadata::CanicMetadataResponse,
10        role::{RoleCapability, RoleOverviewResponse},
11        state::BootstrapStatusResponse,
12    },
13    ids::CanisterRole,
14    role_contract::RoleCapabilityKey,
15};
16use std::collections::BTreeSet;
17
18/// Endpoint-facing adapter for immutable compiled-role verification.
19pub struct RoleOverviewApi;
20
21impl RoleOverviewApi {
22    /// Build one overview from the already resolved build-time capability authority.
23    #[must_use]
24    pub fn overview(
25        role: CanisterRole,
26        capabilities: &BTreeSet<RoleCapabilityKey>,
27        protocol_profile_digest: [u8; 32],
28        metadata: CanicMetadataResponse,
29        bootstrap: BootstrapStatusResponse,
30    ) -> RoleOverviewResponse {
31        let mut capabilities = capabilities
32            .iter()
33            .copied()
34            .filter_map(capability_view)
35            .collect::<Vec<_>>();
36        capabilities.sort_unstable();
37
38        RoleOverviewResponse {
39            role,
40            capabilities,
41            protocol_profile_digest,
42            metadata,
43            bootstrap,
44        }
45    }
46}
47
48const fn capability_view(capability: RoleCapabilityKey) -> Option<RoleCapability> {
49    Some(match capability {
50        RoleCapabilityKey::AutomaticTopup => RoleCapability::AutomaticTopup,
51        RoleCapabilityKey::ChildProvisioning => RoleCapability::ChildProvisioning,
52        RoleCapabilityKey::DelegatedTokenIssuer => RoleCapability::DelegatedTokenIssuer,
53        RoleCapabilityKey::DelegatedTokenVerifier => RoleCapability::DelegatedTokenVerifier,
54        RoleCapabilityKey::FleetAdmissionProjection => RoleCapability::FleetAdmissionProjection,
55        RoleCapabilityKey::FleetCoordinator => RoleCapability::FleetCoordinator,
56        RoleCapabilityKey::Index => RoleCapability::Index,
57        RoleCapabilityKey::Icrc21 => RoleCapability::Icrc21,
58        RoleCapabilityKey::LocalApplicationAuthorization => return None,
59        RoleCapabilityKey::ObservabilityDiagnostics => RoleCapability::ObservabilityDiagnostics,
60        RoleCapabilityKey::ObservabilityHistory => RoleCapability::ObservabilityHistory,
61        RoleCapabilityKey::ObservabilityLogs => RoleCapability::ObservabilityLogs,
62        RoleCapabilityKey::ObservabilityMetrics => RoleCapability::ObservabilityMetrics,
63        RoleCapabilityKey::RoleAttestationSigner => RoleCapability::RoleAttestationSigner,
64        RoleCapabilityKey::RoleAttestationVerifier => RoleCapability::RoleAttestationVerifier,
65        RoleCapabilityKey::Root => RoleCapability::Root,
66        RoleCapabilityKey::RootControlPlane => RoleCapability::RootControlPlane,
67        RoleCapabilityKey::RootDelegation => RoleCapability::RootDelegation,
68        RoleCapabilityKey::Runtime => RoleCapability::Runtime,
69        RoleCapabilityKey::Scaling => RoleCapability::Scaling,
70        RoleCapabilityKey::Sharding => RoleCapability::Sharding,
71        RoleCapabilityKey::WasmStore => RoleCapability::WasmStore,
72    })
73}
74
75#[cfg(test)]
76mod tests {
77    use super::*;
78
79    #[test]
80    fn overview_projects_public_capabilities_in_lexical_order() {
81        let capabilities = BTreeSet::from([
82            RoleCapabilityKey::AutomaticTopup,
83            RoleCapabilityKey::ChildProvisioning,
84            RoleCapabilityKey::DelegatedTokenIssuer,
85            RoleCapabilityKey::DelegatedTokenVerifier,
86            RoleCapabilityKey::FleetAdmissionProjection,
87            RoleCapabilityKey::FleetCoordinator,
88            RoleCapabilityKey::Index,
89            RoleCapabilityKey::Icrc21,
90            RoleCapabilityKey::LocalApplicationAuthorization,
91            RoleCapabilityKey::RoleAttestationSigner,
92            RoleCapabilityKey::RoleAttestationVerifier,
93            RoleCapabilityKey::Root,
94            RoleCapabilityKey::RootControlPlane,
95            RoleCapabilityKey::Runtime,
96            RoleCapabilityKey::Scaling,
97            RoleCapabilityKey::Sharding,
98            RoleCapabilityKey::WasmStore,
99        ]);
100        let overview = RoleOverviewApi::overview(
101            CanisterRole::new("app"),
102            &capabilities,
103            [9; 32],
104            CanicMetadataResponse {
105                package_name: "app".to_string(),
106                package_version: "0.1.0".to_string(),
107                package_description: "test".to_string(),
108                canic_version: "0.103.0".to_string(),
109                canister_version: 4,
110            },
111            BootstrapStatusResponse {
112                ready: true,
113                phase: "ready".to_string(),
114                last_error: None,
115            },
116        );
117
118        assert_eq!(
119            overview.capabilities,
120            vec![
121                RoleCapability::AutomaticTopup,
122                RoleCapability::ChildProvisioning,
123                RoleCapability::DelegatedTokenIssuer,
124                RoleCapability::DelegatedTokenVerifier,
125                RoleCapability::FleetAdmissionProjection,
126                RoleCapability::FleetCoordinator,
127                RoleCapability::Icrc21,
128                RoleCapability::Index,
129                RoleCapability::RoleAttestationSigner,
130                RoleCapability::RoleAttestationVerifier,
131                RoleCapability::Root,
132                RoleCapability::RootControlPlane,
133                RoleCapability::Runtime,
134                RoleCapability::Scaling,
135                RoleCapability::Sharding,
136                RoleCapability::WasmStore,
137            ]
138        );
139        assert_eq!(overview.protocol_profile_digest, [9; 32]);
140    }
141}
canic_core/api/role.rs

canic_core/api/
role.rs
