canic_core/dto/auth/
renewal.rs

1//! Module: dto::auth::renewal
2//!
3//! Responsibility: root issuer policy and renewal status DTOs.
4//! Does not own: scheduling, proof batch creation, or install result mutation.
5//! Boundary: passive operator/root endpoint contracts for issuer renewal state.
6
7use super::{DelegatedRoleGrant, DelegationAudience, DelegationProof};
8use crate::dto::prelude::*;
9
10//
11// RootDelegationProofBatchProofRef
12//
13
14#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
15pub struct RootDelegationProofBatchProofRef {
16    pub issuer_pid: Principal,
17    pub cert_hash: [u8; 32],
18}
19
20//
21// RootDelegationProofBatchProof
22//
23
24#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
25pub struct RootDelegationProofBatchProof {
26    pub issuer_pid: Principal,
27    pub cert_hash: [u8; 32],
28    pub proof: DelegationProof,
29}
30
31//
32// RootIssuerPolicyUpsertRequest
33//
34
35#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
36pub struct RootIssuerPolicyUpsertRequest {
37    pub issuer_pid: Principal,
38    pub enabled: bool,
39    pub allowed_audiences: Vec<DelegationAudience>,
40    pub allowed_grants: Vec<DelegatedRoleGrant>,
41    pub max_cert_ttl_ns: u64,
42    pub refresh_after_ratio_bps: u16,
43}
44
45//
46// RootIssuerPolicyView
47//
48
49#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
50pub struct RootIssuerPolicyView {
51    pub issuer_pid: Principal,
52    pub enabled: bool,
53    pub allowed_audiences: Vec<DelegationAudience>,
54    pub allowed_grants: Vec<DelegatedRoleGrant>,
55    pub max_cert_ttl_ns: u64,
56    pub refresh_after_ratio_bps: u16,
57}
58
59//
60// RootIssuerPolicyResponse
61//
62
63#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
64pub struct RootIssuerPolicyResponse {
65    pub issuer: RootIssuerPolicyView,
66}
67
68//
69// RootIssuerRenewalTemplateUpsertRequest
70//
71
72#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
73pub struct RootIssuerRenewalTemplateUpsertRequest {
74    pub issuer_pid: Principal,
75    pub enabled: bool,
76    pub aud: DelegationAudience,
77    pub grants: Vec<DelegatedRoleGrant>,
78    pub cert_ttl_ns: u64,
79}
80
81//
82// RootIssuerRenewalTemplateView
83//
84
85#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
86pub struct RootIssuerRenewalTemplateView {
87    pub issuer_pid: Principal,
88    pub enabled: bool,
89    pub aud: DelegationAudience,
90    pub grants: Vec<DelegatedRoleGrant>,
91    pub cert_ttl_ns: u64,
92}
93
94//
95// RootIssuerRenewalTemplateResponse
96//
97
98#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
99pub struct RootIssuerRenewalTemplateResponse {
100    pub template: RootIssuerRenewalTemplateView,
101}
102
103//
104// RootIssuerRenewalStatusRequest
105//
106
107#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
108pub struct RootIssuerRenewalStatusRequest {
109    pub issuer_pid: Principal,
110}
111
112//
113// RootIssuerRenewalOutcome
114//
115
116#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
117pub enum RootIssuerRenewalOutcome {
118    AlreadyInstalled,
119    DriftDetected,
120    InstallDeadlineExpired,
121    Installed,
122    IssuerCallFailed,
123    NeverRun,
124    PolicyRejected,
125    ProofMismatch,
126    QuotaExceeded,
127    RejectedByIssuer,
128    RetrievalExpired,
129    TemplateChanged,
130    TemplateDisabled,
131}
132
133//
134// RootIssuerRenewalAttemptStatus
135//
136
137#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
138pub enum RootIssuerRenewalAttemptStatus {
139    Prepared,
140    Installing,
141    Installed,
142    FailedRetryable,
143    FailedTerminal,
144    Disabled,
145    Expired,
146}
147
148//
149// RootIssuerRenewalAttemptView
150//
151
152#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
153pub struct RootIssuerRenewalAttemptView {
154    pub attempt_id: [u8; 32],
155    pub issuer_pid: Principal,
156    pub template_fingerprint: [u8; 32],
157    pub batch_id: [u8; 32],
158    pub proof_ref: RootDelegationProofBatchProofRef,
159    pub status: RootIssuerRenewalAttemptStatus,
160    pub prepared_at_ns: u64,
161    pub retrieval_expires_at_ns: u64,
162    pub install_deadline_ns: u64,
163    pub prepared_cert_hash: [u8; 32],
164    pub prepared_expires_at_ns: u64,
165    pub prepared_refresh_after_ns: u64,
166    pub failure: Option<RootIssuerRenewalOutcome>,
167}
168
169//
170// RootIssuerRenewalStateView
171//
172
173#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
174pub struct RootIssuerRenewalStateView {
175    pub issuer_pid: Principal,
176    pub template_fingerprint: [u8; 32],
177    pub last_installed_cert_hash: Option<[u8; 32]>,
178    pub last_installed_expires_at_ns: Option<u64>,
179    pub last_installed_refresh_after_ns: Option<u64>,
180    pub active_attempt_id: Option<[u8; 32]>,
181    pub last_outcome: RootIssuerRenewalOutcome,
182    pub consecutive_failures: u32,
183    pub next_attempt_after_ns: u64,
184    pub updated_at_ns: u64,
185}
186
187//
188// RootIssuerRenewalStatusResponse
189//
190
191#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
192pub struct RootIssuerRenewalStatusResponse {
193    pub template: Option<RootIssuerRenewalTemplateView>,
194    pub state: Option<RootIssuerRenewalStateView>,
195    pub active_attempt: Option<RootIssuerRenewalAttemptView>,
196}
canic_core/dto/auth/renewal.rs

canic_core/dto/auth/
renewal.rs
