canic_core/dto/auth/
renewal.rs

1//! Module: dto::auth::renewal
2//!
3//! Responsibility: root issuer policy and renewal status DTOs.
4//! Does not own: scheduling, proof batch creation, or install result mutation.
5//! Boundary: passive operator/root endpoint contracts for issuer renewal state.
6
7use super::{DelegatedRoleGrant, DelegationAudience, DelegationProof};
8use crate::dto::prelude::*;
9
10//
11// RootDelegationProofBatchProof
12//
13
14#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
15pub struct RootDelegationProofBatchProof {
16    pub issuer_pid: Principal,
17    pub cert_hash: [u8; 32],
18    pub proof: DelegationProof,
19}
20
21//
22// RootIssuerPolicyUpsertRequest
23//
24
25#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
26pub struct RootIssuerPolicyUpsertRequest {
27    pub issuer_pid: Principal,
28    pub enabled: bool,
29    pub allowed_audiences: Vec<DelegationAudience>,
30    pub allowed_grants: Vec<DelegatedRoleGrant>,
31    pub max_cert_ttl_ns: u64,
32    pub refresh_after_ratio_bps: u16,
33}
34
35//
36// RootIssuerPolicyView
37//
38
39#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
40pub struct RootIssuerPolicyView {
41    pub issuer_pid: Principal,
42    pub enabled: bool,
43    pub allowed_audiences: Vec<DelegationAudience>,
44    pub allowed_grants: Vec<DelegatedRoleGrant>,
45    pub max_cert_ttl_ns: u64,
46    pub refresh_after_ratio_bps: u16,
47}
48
49//
50// RootIssuerPolicyResponse
51//
52
53#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
54pub struct RootIssuerPolicyResponse {
55    pub issuer: RootIssuerPolicyView,
56}
57
58//
59// RootIssuerRenewalTemplateUpsertRequest
60//
61
62#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
63pub struct RootIssuerRenewalTemplateUpsertRequest {
64    pub issuer_pid: Principal,
65    pub enabled: bool,
66    pub aud: DelegationAudience,
67    pub grants: Vec<DelegatedRoleGrant>,
68    pub cert_ttl_ns: u64,
69}
70
71//
72// RootIssuerRenewalTemplateView
73//
74
75#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
76pub struct RootIssuerRenewalTemplateView {
77    pub issuer_pid: Principal,
78    pub enabled: bool,
79    pub aud: DelegationAudience,
80    pub grants: Vec<DelegatedRoleGrant>,
81    pub cert_ttl_ns: u64,
82}
83
84//
85// RootIssuerRenewalTemplateResponse
86//
87
88#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
89pub struct RootIssuerRenewalTemplateResponse {
90    pub template: RootIssuerRenewalTemplateView,
91}
92
93//
94// RootIssuerRenewalStatusRequest
95//
96
97#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
98pub struct RootIssuerRenewalStatusRequest {
99    pub issuer_pid: Principal,
100}
101
102//
103// RootIssuerRenewalBatchStatus
104//
105
106#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
107pub enum RootIssuerRenewalBatchStatus {
108    Prepared,
109    Signing,
110    Signed,
111    Installing,
112    Installed,
113    FailedRetryable,
114}
115
116//
117// RootIssuerRenewalBatchView
118//
119
120#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
121pub struct RootIssuerRenewalBatchView {
122    pub batch_id: [u8; 32],
123    pub status: RootIssuerRenewalBatchStatus,
124    pub cert_hash: [u8; 32],
125    pub proof_epoch: u64,
126    pub prepared_at_ns: u64,
127    pub expires_at_ns: u64,
128    pub installed_at_ns: Option<u64>,
129    pub retry_after_ns: Option<u64>,
130    pub failure: Option<String>,
131}
132
133//
134// RootIssuerRenewalStateView
135//
136
137#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
138pub struct RootIssuerRenewalStateView {
139    pub issuer_pid: Principal,
140    pub template_fingerprint: [u8; 32],
141    pub last_installed_cert_hash: Option<[u8; 32]>,
142    pub last_installed_expires_at_ns: Option<u64>,
143    pub last_installed_refresh_after_ns: Option<u64>,
144    pub next_attempt_after_ns: u64,
145    pub updated_at_ns: u64,
146}
147
148//
149// RootIssuerRenewalStatusResponse
150//
151
152#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
153pub struct RootIssuerRenewalStatusResponse {
154    pub template: Option<RootIssuerRenewalTemplateView>,
155    pub state: Option<RootIssuerRenewalStateView>,
156    pub latest_batch: Option<RootIssuerRenewalBatchView>,
157}
canic_core/dto/auth/renewal.rs

canic_core/dto/auth/
renewal.rs
