canic_host/deployment_truth/model/root_verification/
mod.rs

1use super::{DeploymentCheckV1, DeploymentRootObservationSourceV1, SafetyFindingV1};
2use serde::{Deserialize, Serialize};
3
4///
5/// DeploymentRootVerificationRequestV1
6///
7#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
8pub struct DeploymentRootVerificationRequestV1 {
9    pub report_id: String,
10    pub requested_at: String,
11    pub deployment_name: String,
12    pub network: String,
13    pub expected_fleet_template: String,
14    pub expected_root_principal: String,
15    pub current_root_verification: DeploymentRootVerificationStateV1,
16    pub source: DeploymentRootVerificationSourceV1,
17    pub deployment_check: DeploymentCheckV1,
18}
19
20///
21/// DeploymentRootVerificationReportV1
22///
23#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
24pub struct DeploymentRootVerificationReportV1 {
25    pub schema_version: u32,
26    pub report_id: String,
27    pub report_digest: String,
28    pub requested_at: String,
29    pub evidence_status: DeploymentRootVerificationEvidenceStatusV1,
30    pub state_transition: DeploymentRootVerificationStateTransitionV1,
31    pub deployment_name: String,
32    pub network: String,
33    pub expected_fleet_template: String,
34    pub expected_root_principal: String,
35    pub observed_deployment_name: Option<String>,
36    pub observed_network: Option<String>,
37    pub observed_fleet_template: Option<String>,
38    pub observed_root_principal: Option<String>,
39    pub observed_root_canister_id: Option<String>,
40    pub observed_root_observation_source: Option<DeploymentRootObservationSourceV1>,
41    pub source: DeploymentRootVerificationSourceV1,
42    pub source_check_id: String,
43    pub source_check_digest: String,
44    pub source_deployment_plan_id: String,
45    pub source_deployment_plan_digest: String,
46    pub source_inventory_id: String,
47    pub source_inventory_digest: String,
48    pub current_root_verification: DeploymentRootVerificationStateV1,
49    pub identity_checks: Vec<DeploymentRootVerificationCheckV1>,
50    pub evidence_checks: Vec<DeploymentRootVerificationCheckV1>,
51    pub blockers: Vec<SafetyFindingV1>,
52    pub warnings: Vec<SafetyFindingV1>,
53    pub recommended_next_actions: Vec<String>,
54}
55
56///
57/// DeploymentRootVerificationReceiptV1
58///
59#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
60pub struct DeploymentRootVerificationReceiptV1 {
61    pub schema_version: u32,
62    pub receipt_id: String,
63    pub receipt_digest: String,
64    pub deployment_name: String,
65    pub network: String,
66    pub fleet_template: String,
67    pub root_principal: String,
68    pub previous_root_verification: DeploymentRootVerificationStateV1,
69    pub new_root_verification: DeploymentRootVerificationStateV1,
70    pub state_transition: DeploymentRootVerificationStateTransitionV1,
71    pub source_report_id: String,
72    pub source_report_digest: String,
73    pub source_report_requested_at: String,
74    pub source_report_source: DeploymentRootVerificationSourceV1,
75    pub source_report_evidence_status: DeploymentRootVerificationEvidenceStatusV1,
76    pub source_report_current_root_verification: DeploymentRootVerificationStateV1,
77    pub source_report_state_transition: DeploymentRootVerificationStateTransitionV1,
78    pub source_root_observation_source: DeploymentRootObservationSourceV1,
79    pub source_observed_root_canister_id: String,
80    pub source_check_id: String,
81    pub source_check_digest: String,
82    pub source_deployment_plan_id: String,
83    pub source_deployment_plan_digest: String,
84    pub source_inventory_id: String,
85    pub source_inventory_digest: String,
86    pub verified_at_unix_secs: u64,
87    pub local_state_path: String,
88    pub local_state_digest_before: String,
89    pub local_state_digest_after: String,
90    pub warnings: Vec<SafetyFindingV1>,
91}
92
93///
94/// DeploymentRootVerificationCheckV1
95///
96#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
97pub struct DeploymentRootVerificationCheckV1 {
98    pub name: String,
99    pub expected: Option<String>,
100    pub observed: Option<String>,
101    pub satisfied: bool,
102}
103
104///
105/// DeploymentRootVerificationSourceV1
106///
107#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
108pub enum DeploymentRootVerificationSourceV1 {
109    DeploymentTruthCheck,
110}
111
112impl DeploymentRootVerificationSourceV1 {
113    #[must_use]
114    pub const fn label(self) -> &'static str {
115        match self {
116            Self::DeploymentTruthCheck => "DeploymentTruthCheck",
117        }
118    }
119}
120
121///
122/// DeploymentRootVerificationEvidenceStatusV1
123///
124#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
125pub enum DeploymentRootVerificationEvidenceStatusV1 {
126    EvidenceSatisfied,
127    VerificationFailed,
128    NotApplicable,
129}
130
131impl DeploymentRootVerificationEvidenceStatusV1 {
132    #[must_use]
133    pub const fn label(self) -> &'static str {
134        match self {
135            Self::EvidenceSatisfied => "EvidenceSatisfied",
136            Self::VerificationFailed => "VerificationFailed",
137            Self::NotApplicable => "NotApplicable",
138        }
139    }
140}
141
142///
143/// DeploymentRootVerificationStateTransitionV1
144///
145#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
146pub enum DeploymentRootVerificationStateTransitionV1 {
147    NotAttempted,
148    WouldPromoteNotVerifiedToVerified,
149    PromotedNotVerifiedToVerified,
150    NoStateChange,
151    Blocked,
152}
153
154impl DeploymentRootVerificationStateTransitionV1 {
155    #[must_use]
156    pub const fn label(self) -> &'static str {
157        match self {
158            Self::NotAttempted => "NotAttempted",
159            Self::WouldPromoteNotVerifiedToVerified => "WouldPromoteNotVerifiedToVerified",
160            Self::PromotedNotVerifiedToVerified => "PromotedNotVerifiedToVerified",
161            Self::NoStateChange => "NoStateChange",
162            Self::Blocked => "Blocked",
163        }
164    }
165}
166
167///
168/// DeploymentRootVerificationStateV1
169///
170#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)]
171pub enum DeploymentRootVerificationStateV1 {
172    NotVerified,
173    Verified,
174}
175
176impl DeploymentRootVerificationStateV1 {
177    #[must_use]
178    pub const fn label(self) -> &'static str {
179        match self {
180            Self::NotVerified => "NotVerified",
181            Self::Verified => "Verified",
182        }
183    }
184}
185
186#[cfg(test)]
187mod tests {
188    use super::*;
189
190    #[test]
191    fn deployment_root_verification_source_owns_text_labels() {
192        assert_eq!(
193            DeploymentRootVerificationSourceV1::DeploymentTruthCheck.label(),
194            "DeploymentTruthCheck"
195        );
196    }
197
198    #[test]
199    fn deployment_root_verification_evidence_status_owns_text_labels() {
200        assert_eq!(
201            DeploymentRootVerificationEvidenceStatusV1::EvidenceSatisfied.label(),
202            "EvidenceSatisfied"
203        );
204        assert_eq!(
205            DeploymentRootVerificationEvidenceStatusV1::VerificationFailed.label(),
206            "VerificationFailed"
207        );
208        assert_eq!(
209            DeploymentRootVerificationEvidenceStatusV1::NotApplicable.label(),
210            "NotApplicable"
211        );
212    }
213
214    #[test]
215    fn deployment_root_verification_state_transition_owns_text_labels() {
216        assert_eq!(
217            DeploymentRootVerificationStateTransitionV1::NotAttempted.label(),
218            "NotAttempted"
219        );
220        assert_eq!(
221            DeploymentRootVerificationStateTransitionV1::WouldPromoteNotVerifiedToVerified.label(),
222            "WouldPromoteNotVerifiedToVerified"
223        );
224        assert_eq!(
225            DeploymentRootVerificationStateTransitionV1::PromotedNotVerifiedToVerified.label(),
226            "PromotedNotVerifiedToVerified"
227        );
228        assert_eq!(
229            DeploymentRootVerificationStateTransitionV1::NoStateChange.label(),
230            "NoStateChange"
231        );
232        assert_eq!(
233            DeploymentRootVerificationStateTransitionV1::Blocked.label(),
234            "Blocked"
235        );
236    }
237
238    #[test]
239    fn deployment_root_verification_state_owns_text_labels() {
240        assert_eq!(
241            DeploymentRootVerificationStateV1::NotVerified.label(),
242            "NotVerified"
243        );
244        assert_eq!(
245            DeploymentRootVerificationStateV1::Verified.label(),
246            "Verified"
247        );
248    }
249}
canic_host/deployment_truth/model/root_verification/mod.rs

canic_host/deployment_truth/model/root_verification/
mod.rs
