Skip to main content

canic_core/dto/auth/
proof.rs

1//! Module: dto::auth::proof
2//!
3//! Responsibility: delegated root proof, issuer proof, and active proof DTOs.
4//! Does not own: proof verification, key validation, or storage mapping.
5//! Boundary: passive proof contracts carried by delegated tokens and issuer installs.
6
7use super::{DelegatedRoleGrant, DelegationAudience};
8use crate::{dto::prelude::*, ids::BuildNetwork};
9
10//
11// RootProof
12//
13
14#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
15pub enum RootProof {
16    IcChainKeyBatchSignatureV1(IcChainKeyBatchSignatureProofV1),
17}
18
19//
20// IssuerProof
21//
22
23#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
24pub enum IssuerProof {
25    IcCanisterSignatureV1(IcCanisterSignatureProofV1),
26}
27
28//
29// IcCanisterSignatureProofV1
30//
31
32#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
33pub struct IcCanisterSignatureProofV1 {
34    pub signature_cbor: Vec<u8>,
35    pub public_key_der: Vec<u8>,
36}
37
38//
39// ChainKeyAlgorithm
40//
41
42#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
43pub enum ChainKeyAlgorithm {
44    EcdsaSecp256k1,
45}
46
47//
48// ChainKeyKeyId
49//
50
51#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
52pub struct ChainKeyKeyId {
53    pub name: String,
54}
55
56//
57// RootKeyPolicyV1
58//
59
60#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
61pub struct RootKeyPolicyV1 {
62    pub root_canister_id: Principal,
63    pub algorithm: ChainKeyAlgorithm,
64    pub key_id: ChainKeyKeyId,
65    pub derivation_path_hash: [u8; 32],
66    pub public_key: Vec<u8>,
67    pub key_version: u64,
68    pub min_accepted_key_version: u64,
69    pub min_accepted_proof_epoch: u64,
70    pub min_accepted_registry_epoch: u64,
71    pub max_revocation_latency_ns: u64,
72    pub valid_from_ns: u64,
73    pub accept_until_ns: u64,
74    pub build_network: BuildNetwork,
75}
76
77//
78// DelegatedAuthRegistrySnapshotV1
79//
80
81#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
82pub struct DelegatedAuthRegistrySnapshotV1 {
83    pub schema_version: u16,
84    pub root_canister_id: Principal,
85    pub registry_epoch: u64,
86    pub root_key_policy_hash: [u8; 32],
87    pub issuer_policies: Vec<DelegatedAuthIssuerPolicySnapshotV1>,
88}
89
90//
91// DelegatedAuthIssuerPolicySnapshotV1
92//
93
94#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
95pub struct DelegatedAuthIssuerPolicySnapshotV1 {
96    pub issuer_canister_id: Principal,
97    pub enabled: bool,
98    pub allowed_audiences: Vec<DelegationAudience>,
99    pub allowed_grants: Vec<DelegatedRoleGrant>,
100    pub max_root_proof_ttl_ns: u64,
101    pub max_token_ttl_ns: u64,
102    pub issuer_proof_algorithm: IssuerProofAlgorithm,
103    pub issuer_proof_binding_hash: [u8; 32],
104    pub renewal_template_hash: [u8; 32],
105}
106
107//
108// IcChainKeyBatchSignatureProofV1
109//
110
111#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
112pub struct IcChainKeyBatchSignatureProofV1 {
113    pub header: ChainKeyBatchHeaderV1,
114    pub delegation_cert: ChainKeyDelegationCertV1,
115    pub issuer_witness: ChainKeyBatchWitnessV1,
116    pub signature: ChainKeyRootSignatureV1,
117}
118
119//
120// ChainKeyBatchHeaderV1
121//
122
123#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
124pub struct ChainKeyBatchHeaderV1 {
125    pub schema_version: u16,
126    pub root_canister_id: Principal,
127    pub batch_id: [u8; 32],
128    pub proof_epoch: u64,
129    pub registry_epoch: u64,
130    pub registry_hash: [u8; 32],
131    pub tree_root: [u8; 32],
132    pub not_before_ns: u64,
133    pub expires_at_ns: u64,
134    pub algorithm: ChainKeyAlgorithm,
135    pub key_id: ChainKeyKeyId,
136    pub derivation_path_hash: [u8; 32],
137    pub key_version: u64,
138}
139
140//
141// ChainKeyDelegationCertV1
142//
143
144#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
145pub struct ChainKeyDelegationCertV1 {
146    pub root_canister_id: Principal,
147    pub issuer_canister_id: Principal,
148    pub proof_epoch: u64,
149    pub issuer_proof_algorithm: IssuerProofAlgorithm,
150    pub issuer_proof_binding_hash: [u8; 32],
151    pub issuer_proof_binding: IssuerProofBinding,
152    pub max_token_ttl_ns: u64,
153    pub audience: DelegationAudience,
154    pub grants: Vec<DelegatedRoleGrant>,
155    pub not_before_ns: u64,
156    pub expires_at_ns: u64,
157    pub registry_epoch: u64,
158    pub registry_hash: [u8; 32],
159}
160
161//
162// ChainKeyRootSignatureV1
163//
164
165#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
166pub struct ChainKeyRootSignatureV1 {
167    pub algorithm: ChainKeyAlgorithm,
168    pub key_id: ChainKeyKeyId,
169    pub derivation_path: Vec<Vec<u8>>,
170    pub public_key: Vec<u8>,
171    pub signature: Vec<u8>,
172}
173
174//
175// ChainKeyBatchWitnessV1
176//
177
178#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
179pub struct ChainKeyBatchWitnessV1 {
180    pub steps: Vec<ChainKeyBatchWitnessStepV1>,
181}
182
183//
184// ChainKeyBatchWitnessStepV1
185//
186
187#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
188pub enum ChainKeyBatchWitnessStepV1 {
189    LeftSibling([u8; 32]),
190    RightSibling([u8; 32]),
191}
192
193//
194// IssuerProofAlgorithm
195//
196
197#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
198pub enum IssuerProofAlgorithm {
199    IcCanisterSignatureV1,
200}
201
202//
203// IssuerProofBinding
204//
205
206#[derive(CandidType, Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
207pub enum IssuerProofBinding {
208    IcCanisterSignatureV1 { seed_hash: [u8; 32] },
209}
210
211//
212// DelegationCert
213//
214
215#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
216pub struct DelegationCert {
217    pub root_pid: Principal,
218    pub issuer_pid: Principal,
219    pub issuer_proof_alg: IssuerProofAlgorithm,
220    pub issuer_proof_binding_hash: [u8; 32],
221    pub issuer_proof_binding: IssuerProofBinding,
222    pub issued_at_ns: u64,
223    pub not_before_ns: u64,
224    pub expires_at_ns: u64,
225    pub max_token_ttl_ns: u64,
226    pub aud: DelegationAudience,
227    pub grants: Vec<DelegatedRoleGrant>,
228}
229
230//
231// DelegationProof
232//
233
234#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
235pub struct DelegationProof {
236    pub cert: DelegationCert,
237    pub root_proof: RootProof,
238}
239
240//
241// ActiveDelegationProof
242//
243
244#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
245pub struct ActiveDelegationProof {
246    pub proof: DelegationProof,
247    pub cert_hash: [u8; 32],
248    pub not_before_ns: u64,
249    pub expires_at_ns: u64,
250    pub refresh_after_ns: u64,
251    pub installed_at_ns: u64,
252    pub installed_by: Principal,
253}
254
255//
256// InstallActiveDelegationProofRequest
257//
258
259#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
260pub struct InstallActiveDelegationProofRequest {
261    pub proof: DelegationProof,
262}
263
264//
265// InstallActiveDelegationProofResponse
266//
267
268#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
269pub struct InstallActiveDelegationProofResponse {
270    pub active_proof: ActiveDelegationProof,
271}
272
273//
274// ActiveDelegationProofStatus
275//
276
277#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
278pub enum ActiveDelegationProofStatus {
279    Missing,
280    Valid,
281    RefreshNeeded,
282    Expired,
283}
284
285//
286// ActiveDelegationProofStatusResponse
287//
288
289#[derive(CandidType, Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
290pub struct ActiveDelegationProofStatusResponse {
291    pub status: ActiveDelegationProofStatus,
292    pub root_pid: Option<Principal>,
293    pub issuer_pid: Option<Principal>,
294    pub cert_hash: Option<[u8; 32]>,
295    pub expires_at_ns: Option<u64>,
296    pub refresh_after_ns: Option<u64>,
297}