Skip to main content

canic_core/dto/auth/
proof.rs

1//! Module: dto::auth::proof
2//!
3//! Responsibility: delegated root proof, issuer proof, and active proof DTOs.
4//! Does not own: proof verification, key validation, or storage mapping.
5//! Boundary: passive proof contracts carried by delegated tokens and issuer installs.
6
7use super::{DelegatedRoleGrant, DelegationAudience};
8use crate::{dto::prelude::*, ids::BuildNetwork};
9
10//
11// RootProof
12//
13
14#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
15pub enum RootProof {
16    IcChainKeyBatchSignatureV1(IcChainKeyBatchSignatureProofV1),
17}
18
19//
20// IssuerProof
21//
22
23#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
24pub enum IssuerProof {
25    IcCanisterSignatureV1(IcCanisterSignatureProofV1),
26}
27
28//
29// IcCanisterSignatureProofV1
30//
31
32#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
33pub struct IcCanisterSignatureProofV1 {
34    pub signature_cbor: Vec<u8>,
35    pub public_key_der: Vec<u8>,
36}
37
38//
39// ChainKeyAlgorithm
40//
41
42#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
43pub enum ChainKeyAlgorithm {
44    EcdsaSecp256k1,
45}
46
47//
48// ChainKeyKeyId
49//
50
51#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
52pub struct ChainKeyKeyId {
53    pub name: String,
54}
55
56//
57// RootChainKeyPublicKeyRequest
58//
59
60/// Controller request to derive a public key for this Root's ECDSA identity.
61#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
62pub struct RootChainKeyPublicKeyRequest {
63    pub key_id: String,
64    pub derivation_path: Vec<Vec<u8>>,
65}
66
67//
68// RootKeyPolicyV1
69//
70
71#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
72pub struct RootKeyPolicyV1 {
73    pub root_canister_id: Principal,
74    pub algorithm: ChainKeyAlgorithm,
75    pub key_id: ChainKeyKeyId,
76    pub derivation_path_hash: [u8; 32],
77    pub public_key: Vec<u8>,
78    pub key_version: u64,
79    pub min_accepted_key_version: u64,
80    pub min_accepted_proof_epoch: u64,
81    pub min_accepted_registry_epoch: u64,
82    pub max_revocation_latency_ns: u64,
83    pub valid_from_ns: u64,
84    pub accept_until_ns: u64,
85    pub build_network: BuildNetwork,
86}
87
88//
89// DelegatedAuthRegistrySnapshotV1
90//
91
92#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
93pub struct DelegatedAuthRegistrySnapshotV1 {
94    pub schema_version: u16,
95    pub root_canister_id: Principal,
96    pub registry_epoch: u64,
97    pub root_key_policy_hash: [u8; 32],
98    pub issuer_policies: Vec<DelegatedAuthIssuerPolicySnapshotV1>,
99}
100
101//
102// DelegatedAuthIssuerPolicySnapshotV1
103//
104
105#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
106pub struct DelegatedAuthIssuerPolicySnapshotV1 {
107    pub issuer_canister_id: Principal,
108    pub enabled: bool,
109    pub allowed_audiences: Vec<DelegationAudience>,
110    pub allowed_grants: Vec<DelegatedRoleGrant>,
111    pub max_root_proof_ttl_ns: u64,
112    pub max_token_ttl_ns: u64,
113    pub issuer_proof_algorithm: IssuerProofAlgorithm,
114    pub issuer_proof_binding_hash: [u8; 32],
115    pub renewal_template_hash: [u8; 32],
116}
117
118//
119// IcChainKeyBatchSignatureProofV1
120//
121
122#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
123pub struct IcChainKeyBatchSignatureProofV1 {
124    pub header: ChainKeyBatchHeaderV1,
125    pub delegation_cert: ChainKeyDelegationCertV1,
126    pub issuer_witness: ChainKeyBatchWitnessV1,
127    pub signature: ChainKeyRootSignatureV1,
128}
129
130//
131// ChainKeyBatchHeaderV1
132//
133
134#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
135pub struct ChainKeyBatchHeaderV1 {
136    pub schema_version: u16,
137    pub root_canister_id: Principal,
138    pub batch_id: [u8; 32],
139    pub proof_epoch: u64,
140    pub registry_epoch: u64,
141    pub registry_hash: [u8; 32],
142    pub tree_root: [u8; 32],
143    pub not_before_ns: u64,
144    pub expires_at_ns: u64,
145    pub algorithm: ChainKeyAlgorithm,
146    pub key_id: ChainKeyKeyId,
147    pub derivation_path_hash: [u8; 32],
148    pub key_version: u64,
149}
150
151//
152// ChainKeyDelegationCertV1
153//
154
155#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
156pub struct ChainKeyDelegationCertV1 {
157    pub root_canister_id: Principal,
158    pub issuer_canister_id: Principal,
159    pub proof_epoch: u64,
160    pub issuer_proof_algorithm: IssuerProofAlgorithm,
161    pub issuer_proof_binding_hash: [u8; 32],
162    pub issuer_proof_binding: IssuerProofBinding,
163    pub max_token_ttl_ns: u64,
164    pub audience: DelegationAudience,
165    pub grants: Vec<DelegatedRoleGrant>,
166    pub not_before_ns: u64,
167    pub expires_at_ns: u64,
168    pub registry_epoch: u64,
169    pub registry_hash: [u8; 32],
170}
171
172//
173// ChainKeyRootSignatureV1
174//
175
176#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
177pub struct ChainKeyRootSignatureV1 {
178    pub algorithm: ChainKeyAlgorithm,
179    pub key_id: ChainKeyKeyId,
180    pub derivation_path: Vec<Vec<u8>>,
181    pub public_key: Vec<u8>,
182    pub signature: Vec<u8>,
183}
184
185//
186// ChainKeyBatchWitnessV1
187//
188
189#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
190pub struct ChainKeyBatchWitnessV1 {
191    pub steps: Vec<ChainKeyBatchWitnessStepV1>,
192}
193
194//
195// ChainKeyBatchWitnessStepV1
196//
197
198#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
199pub enum ChainKeyBatchWitnessStepV1 {
200    LeftSibling([u8; 32]),
201    RightSibling([u8; 32]),
202}
203
204//
205// IssuerProofAlgorithm
206//
207
208#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
209pub enum IssuerProofAlgorithm {
210    IcCanisterSignatureV1,
211}
212
213//
214// IssuerProofBinding
215//
216
217#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
218pub enum IssuerProofBinding {
219    IcCanisterSignatureV1 { seed_hash: [u8; 32] },
220}
221
222//
223// DelegationCert
224//
225
226#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
227pub struct DelegationCert {
228    pub root_pid: Principal,
229    pub issuer_pid: Principal,
230    pub issuer_proof_alg: IssuerProofAlgorithm,
231    pub issuer_proof_binding_hash: [u8; 32],
232    pub issuer_proof_binding: IssuerProofBinding,
233    pub issued_at_ns: u64,
234    pub not_before_ns: u64,
235    pub expires_at_ns: u64,
236    pub max_token_ttl_ns: u64,
237    pub aud: DelegationAudience,
238    pub grants: Vec<DelegatedRoleGrant>,
239}
240
241//
242// DelegationProof
243//
244
245#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
246pub struct DelegationProof {
247    pub cert: DelegationCert,
248    pub root_proof: RootProof,
249}
250
251//
252// ActiveDelegationProof
253//
254
255#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
256pub struct ActiveDelegationProof {
257    pub proof: DelegationProof,
258    pub cert_hash: [u8; 32],
259    pub not_before_ns: u64,
260    pub expires_at_ns: u64,
261    pub refresh_after_ns: u64,
262    pub installed_at_ns: u64,
263    pub installed_by: Principal,
264}
265
266//
267// InstallActiveDelegationProofRequest
268//
269
270#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
271pub struct InstallActiveDelegationProofRequest {
272    pub proof: DelegationProof,
273}
274
275//
276// InstallActiveDelegationProofResponse
277//
278
279#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
280pub struct InstallActiveDelegationProofResponse {
281    pub active_proof: ActiveDelegationProof,
282}
283
284//
285// ActiveDelegationProofStatus
286//
287
288#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
289pub enum ActiveDelegationProofStatus {
290    Missing,
291    Valid,
292    RefreshNeeded,
293    Expired,
294}
295
296//
297// ActiveDelegationProofStatusResponse
298//
299
300#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
301pub struct ActiveDelegationProofStatusResponse {
302    pub status: ActiveDelegationProofStatus,
303    pub root_pid: Option<Principal>,
304    pub issuer_pid: Option<Principal>,
305    pub cert_hash: Option<[u8; 32]>,
306    pub expires_at_ns: Option<u64>,
307    pub refresh_after_ns: Option<u64>,
308}