1use super::*;
2
3#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
4#[serde(rename_all = "camelCase")]
5pub struct GovernedAuthorizationCommerceDetail {
6 pub seller: String,
7 pub shared_payment_token_id: String,
8}
9
10#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
11#[serde(rename_all = "camelCase")]
12pub struct GovernedAuthorizationMeteredBillingDetail {
13 pub settlement_mode: MeteredSettlementMode,
14 pub provider: String,
15 pub quote_id: String,
16 pub billing_unit: String,
17 pub quoted_units: u64,
18 pub quoted_cost: MonetaryAmount,
19 #[serde(default, skip_serializing_if = "Option::is_none")]
20 pub max_billed_units: Option<u64>,
21}
22
23#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
24#[serde(rename_all = "camelCase")]
25pub struct GovernedAuthorizationDetail {
26 #[serde(rename = "type")]
27 pub detail_type: String,
28 #[serde(default, skip_serializing_if = "Vec::is_empty")]
29 pub locations: Vec<String>,
30 #[serde(default, skip_serializing_if = "Vec::is_empty")]
31 pub actions: Vec<String>,
32 #[serde(default, skip_serializing_if = "Option::is_none")]
33 pub purpose: Option<String>,
34 #[serde(default, skip_serializing_if = "Option::is_none")]
35 pub max_amount: Option<MonetaryAmount>,
36 #[serde(default, skip_serializing_if = "Option::is_none")]
37 pub commerce: Option<GovernedAuthorizationCommerceDetail>,
38 #[serde(default, skip_serializing_if = "Option::is_none")]
39 pub metered_billing: Option<GovernedAuthorizationMeteredBillingDetail>,
40}
41
42#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
43#[serde(rename_all = "camelCase")]
44pub struct GovernedAuthorizationTransactionContext {
45 pub intent_id: String,
46 pub intent_hash: String,
47 #[serde(default, skip_serializing_if = "Option::is_none")]
48 pub approval_token_id: Option<String>,
49 #[serde(default, skip_serializing_if = "Option::is_none")]
50 pub approval_approved: Option<bool>,
51 #[serde(default, skip_serializing_if = "Option::is_none")]
52 pub approver_key: Option<String>,
53 #[serde(default, skip_serializing_if = "Option::is_none")]
54 pub runtime_assurance_tier: Option<RuntimeAssuranceTier>,
55 #[serde(default, skip_serializing_if = "Option::is_none")]
56 pub runtime_assurance_schema: Option<String>,
57 #[serde(default, skip_serializing_if = "Option::is_none")]
58 pub runtime_assurance_verifier_family: Option<AttestationVerifierFamily>,
59 #[serde(default, skip_serializing_if = "Option::is_none")]
60 pub runtime_assurance_verifier: Option<String>,
61 #[serde(default, skip_serializing_if = "Option::is_none")]
62 pub runtime_assurance_evidence_sha256: Option<String>,
63 #[serde(default, skip_serializing_if = "Option::is_none")]
64 pub call_chain: Option<GovernedCallChainProvenance>,
65 #[serde(default, skip_serializing_if = "Option::is_none")]
66 pub identity_assertion: Option<ChioIdentityAssertion>,
67}
68
69#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
70#[serde(rename_all = "camelCase")]
71pub struct GovernedTransactionDiagnostics {
72 #[serde(default, skip_serializing_if = "Option::is_none")]
73 pub asserted_call_chain: Option<GovernedCallChainProvenance>,
74 #[serde(default, skip_serializing_if = "EvidenceLineageReferences::is_empty")]
75 pub lineage_references: EvidenceLineageReferences,
76}
77
78impl GovernedTransactionDiagnostics {
79 #[must_use]
80 pub fn is_empty(&self) -> bool {
81 self.asserted_call_chain.is_none() && self.lineage_references.is_empty()
82 }
83}
84
85fn default_authorization_context_report_schema() -> String {
86 CHIO_OAUTH_AUTHORIZATION_CONTEXT_REPORT_SCHEMA.to_string()
87}
88
89fn default_chio_oauth_authorization_profile() -> ChioOAuthAuthorizationProfile {
90 ChioOAuthAuthorizationProfile::default()
91}
92
93#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
94#[serde(rename_all = "camelCase")]
95pub struct ChioOAuthAuthorizationProfile {
96 pub schema: String,
97 pub id: String,
98 pub authoritative_source: String,
99 pub authorization_detail_types: Vec<String>,
100 pub transaction_context_fields: Vec<String>,
101 #[serde(default)]
102 pub portable_claim_catalog: ChioPortableClaimCatalog,
103 #[serde(default)]
104 pub portable_identity_binding: ChioPortableIdentityBinding,
105 #[serde(default)]
106 pub governed_auth_binding: ChioGovernedAuthorizationBinding,
107 #[serde(default)]
108 pub request_time_contract: ChioOAuthRequestTimeContract,
109 #[serde(default)]
110 pub resource_binding: ChioOAuthResourceBinding,
111 #[serde(default)]
112 pub artifact_boundary: ChioOAuthArtifactBoundary,
113 pub sender_constraints: ChioOAuthSenderConstraintProfile,
114 pub unsupported_shapes_fail_closed: bool,
115}
116
117#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
118#[serde(rename_all = "camelCase")]
119pub struct ChioOAuthRequestTimeContract {
120 pub authorization_details_parameter: String,
121 pub transaction_context_parameter: String,
122 pub access_token_authorization_details_claim: String,
123 pub access_token_transaction_context_claim: String,
124 pub request_time_authorization_details_supported: bool,
125 pub request_time_transaction_context_supported: bool,
126 pub governed_receipts_authoritative_post_execution: bool,
127}
128
129impl Default for ChioOAuthRequestTimeContract {
130 fn default() -> Self {
131 Self {
132 authorization_details_parameter:
133 CHIO_OAUTH_REQUEST_TIME_AUTHORIZATION_DETAILS_PARAMETER.to_string(),
134 transaction_context_parameter: CHIO_OAUTH_REQUEST_TIME_TRANSACTION_CONTEXT_PARAMETER
135 .to_string(),
136 access_token_authorization_details_claim:
137 CHIO_OAUTH_REQUEST_TIME_AUTHORIZATION_DETAILS_CLAIM.to_string(),
138 access_token_transaction_context_claim:
139 CHIO_OAUTH_REQUEST_TIME_TRANSACTION_CONTEXT_CLAIM.to_string(),
140 request_time_authorization_details_supported: true,
141 request_time_transaction_context_supported: true,
142 governed_receipts_authoritative_post_execution: true,
143 }
144 }
145}
146
147#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
148#[serde(rename_all = "camelCase")]
149pub struct ChioOAuthResourceBinding {
150 pub protected_resource_field: String,
151 pub request_resource_parameter: String,
152 pub access_token_audience_claim: String,
153 pub access_token_resource_claim: String,
154 pub request_resource_must_match_protected_resource: bool,
155 pub bearer_token_must_include_audience_or_resource: bool,
156}
157
158impl Default for ChioOAuthResourceBinding {
159 fn default() -> Self {
160 Self {
161 protected_resource_field: "resource".to_string(),
162 request_resource_parameter: "resource".to_string(),
163 access_token_audience_claim: "aud".to_string(),
164 access_token_resource_claim: "resource".to_string(),
165 request_resource_must_match_protected_resource: true,
166 bearer_token_must_include_audience_or_resource: true,
167 }
168 }
169}
170
171#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
172#[serde(rename_all = "camelCase")]
173pub struct ChioOAuthArtifactBoundary {
174 pub access_tokens_runtime_admission_supported: bool,
175 pub approval_tokens_runtime_admission_supported: bool,
176 pub capabilities_runtime_admission_supported: bool,
177 pub reviewer_evidence_runtime_admission_supported: bool,
178 pub governed_receipts_audit_evidence_supported: bool,
179}
180
181impl Default for ChioOAuthArtifactBoundary {
182 fn default() -> Self {
183 Self {
184 access_tokens_runtime_admission_supported: true,
185 approval_tokens_runtime_admission_supported: false,
186 capabilities_runtime_admission_supported: false,
187 reviewer_evidence_runtime_admission_supported: false,
188 governed_receipts_audit_evidence_supported: true,
189 }
190 }
191}
192
193#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
194#[serde(rename_all = "camelCase")]
195pub struct ChioOAuthSenderConstraintProfile {
196 pub schema: String,
197 pub subject_binding: String,
198 pub proof_types_supported: Vec<String>,
199 pub proof_required_when: String,
200 pub runtime_assurance_binding_fields: Vec<String>,
201 pub delegated_call_chain_field: String,
202 pub unsupported_sender_shapes_fail_closed: bool,
203}
204
205impl Default for ChioOAuthSenderConstraintProfile {
206 fn default() -> Self {
207 Self {
208 schema: CHIO_OAUTH_SENDER_CONSTRAINT_SCHEMA.to_string(),
209 subject_binding: CHIO_OAUTH_SENDER_BINDING_CAPABILITY_SUBJECT.to_string(),
210 proof_types_supported: vec![
211 CHIO_OAUTH_SENDER_PROOF_CHIO_DPOP.to_string(),
212 CHIO_OAUTH_SENDER_PROOF_CHIO_MTLS.to_string(),
213 CHIO_OAUTH_SENDER_PROOF_CHIO_ATTESTATION.to_string(),
214 ],
215 proof_required_when: "matchedGrant.dpopRequired == true".to_string(),
216 runtime_assurance_binding_fields: vec![
217 "runtimeAssuranceTier".to_string(),
218 "runtimeAssuranceSchema".to_string(),
219 "runtimeAssuranceVerifierFamily".to_string(),
220 "runtimeAssuranceVerifier".to_string(),
221 "runtimeAssuranceEvidenceSha256".to_string(),
222 ],
223 delegated_call_chain_field: "callChain".to_string(),
224 unsupported_sender_shapes_fail_closed: true,
225 }
226 }
227}
228
229impl Default for ChioOAuthAuthorizationProfile {
230 fn default() -> Self {
231 Self {
232 schema: CHIO_OAUTH_AUTHORIZATION_PROFILE_SCHEMA.to_string(),
233 id: CHIO_OAUTH_AUTHORIZATION_PROFILE_ID.to_string(),
234 authoritative_source: "governed_receipt_projection".to_string(),
235 authorization_detail_types: vec![
236 CHIO_OAUTH_AUTHORIZATION_TOOL_DETAIL_TYPE.to_string(),
237 CHIO_OAUTH_AUTHORIZATION_COMMERCE_DETAIL_TYPE.to_string(),
238 CHIO_OAUTH_AUTHORIZATION_METERED_BILLING_DETAIL_TYPE.to_string(),
239 ],
240 transaction_context_fields: vec![
241 "intentId".to_string(),
242 "intentHash".to_string(),
243 "approvalTokenId".to_string(),
244 "approvalApproved".to_string(),
245 "approverKey".to_string(),
246 "runtimeAssuranceTier".to_string(),
247 "runtimeAssuranceSchema".to_string(),
248 "runtimeAssuranceVerifierFamily".to_string(),
249 "runtimeAssuranceVerifier".to_string(),
250 "runtimeAssuranceEvidenceSha256".to_string(),
251 "callChain".to_string(),
252 "identityAssertion".to_string(),
253 ],
254 portable_claim_catalog: ChioPortableClaimCatalog::default(),
255 portable_identity_binding: ChioPortableIdentityBinding::default(),
256 governed_auth_binding: ChioGovernedAuthorizationBinding::default(),
257 request_time_contract: ChioOAuthRequestTimeContract::default(),
258 resource_binding: ChioOAuthResourceBinding::default(),
259 artifact_boundary: ChioOAuthArtifactBoundary::default(),
260 sender_constraints: ChioOAuthSenderConstraintProfile::default(),
261 unsupported_shapes_fail_closed: true,
262 }
263 }
264}
265
266#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
267#[serde(rename_all = "camelCase")]
268pub struct AuthorizationContextSummary {
269 pub matching_receipts: u64,
270 pub returned_receipts: u64,
271 pub approval_receipts: u64,
272 pub approved_receipts: u64,
273 pub commerce_receipts: u64,
274 pub metered_billing_receipts: u64,
275 pub runtime_assurance_receipts: u64,
276 pub call_chain_receipts: u64,
277 pub asserted_call_chain_receipts: u64,
278 pub observed_call_chain_receipts: u64,
279 pub verified_call_chain_receipts: u64,
280 pub max_amount_receipts: u64,
281 pub sender_bound_receipts: u64,
282 pub dpop_bound_receipts: u64,
283 pub runtime_assurance_bound_receipts: u64,
284 pub delegated_sender_bound_receipts: u64,
285 pub session_anchor_receipts: u64,
286 pub request_lineage_receipts: u64,
287 pub receipt_lineage_statement_receipts: u64,
288 pub truncated: bool,
289}
290
291#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
292#[serde(rename_all = "camelCase")]
293pub struct AuthorizationContextSenderConstraint {
294 pub subject_key: String,
295 pub subject_key_source: String,
296 #[serde(default, skip_serializing_if = "String::is_empty")]
297 pub issuer_key: String,
298 #[serde(default, skip_serializing_if = "String::is_empty")]
299 pub issuer_key_source: String,
300 pub matched_grant_index: u32,
301 pub proof_required: bool,
302 #[serde(default, skip_serializing_if = "Option::is_none")]
303 pub proof_type: Option<String>,
304 #[serde(default, skip_serializing_if = "Option::is_none")]
305 pub proof_schema: Option<String>,
306 pub runtime_assurance_bound: bool,
307 pub delegated_call_chain_bound: bool,
308}
309
310#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
311#[serde(rename_all = "camelCase")]
312pub struct AuthorizationContextRow {
313 pub receipt_id: String,
314 pub timestamp: u64,
315 pub capability_id: String,
316 #[serde(default, skip_serializing_if = "Option::is_none")]
317 pub subject_key: Option<String>,
318 pub tool_server: String,
319 pub tool_name: String,
320 #[serde(default, skip_serializing_if = "Option::is_none")]
321 pub decision: Option<Decision>,
322 pub authorization_details: Vec<GovernedAuthorizationDetail>,
323 pub transaction_context: GovernedAuthorizationTransactionContext,
324 #[serde(default, skip_serializing_if = "Option::is_none")]
325 pub governed_transaction_diagnostics: Option<GovernedTransactionDiagnostics>,
326 pub sender_constraint: AuthorizationContextSenderConstraint,
327}
328
329#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
330#[serde(rename_all = "camelCase")]
331pub struct AuthorizationContextReport {
332 #[serde(default = "default_authorization_context_report_schema")]
333 pub schema: String,
334 #[serde(default = "default_chio_oauth_authorization_profile")]
335 pub profile: ChioOAuthAuthorizationProfile,
336 pub summary: AuthorizationContextSummary,
337 pub receipts: Vec<AuthorizationContextRow>,
338}
339
340#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
341#[serde(rename_all = "camelCase")]
342pub struct ChioOAuthAuthorizationDiscoveryMetadata {
343 pub protected_resource_metadata_paths: Vec<String>,
344 pub authorization_server_metadata_path_template: String,
345 pub discovery_informational_only: bool,
346}
347
348#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
349#[serde(rename_all = "camelCase")]
350pub struct ChioOAuthAuthorizationSupportBoundary {
351 pub governed_receipts_authoritative: bool,
352 pub hosted_request_time_authorization_supported: bool,
353 pub resource_indicator_binding_supported: bool,
354 pub sender_constrained_projection: bool,
355 pub runtime_assurance_projection: bool,
356 pub delegated_call_chain_projection: bool,
357 pub generic_token_issuance_supported: bool,
358 pub oidc_identity_assertions_supported: bool,
359 pub mtls_transport_binding_in_profile: bool,
360 pub approval_tokens_runtime_authorization_supported: bool,
361 pub capabilities_runtime_authorization_supported: bool,
362 pub reviewer_evidence_runtime_authorization_supported: bool,
363}
364
365#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
366#[serde(rename_all = "camelCase")]
367pub struct ChioOAuthAuthorizationExampleMapping {
368 pub authorization_detail_types: Vec<String>,
369 pub transaction_context_fields: Vec<String>,
370 pub sender_constraint_fields: Vec<String>,
371}
372
373#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
374#[serde(rename_all = "camelCase")]
375pub struct ChioOAuthAuthorizationMetadataReport {
376 pub schema: String,
377 pub generated_at: u64,
378 pub profile: ChioOAuthAuthorizationProfile,
379 pub report_schema: String,
380 pub discovery: ChioOAuthAuthorizationDiscoveryMetadata,
381 pub support_boundary: ChioOAuthAuthorizationSupportBoundary,
382 pub example_mapping: ChioOAuthAuthorizationExampleMapping,
383}
384
385#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
386#[serde(rename_all = "camelCase")]
387pub struct ChioOAuthAuthorizationReviewPackSummary {
388 pub matching_receipts: u64,
389 pub returned_receipts: u64,
390 pub dpop_required_receipts: u64,
391 pub runtime_assurance_receipts: u64,
392 pub delegated_call_chain_receipts: u64,
393 pub asserted_call_chain_receipts: u64,
394 pub observed_call_chain_receipts: u64,
395 pub verified_call_chain_receipts: u64,
396 pub session_anchor_receipts: u64,
397 pub request_lineage_receipts: u64,
398 pub receipt_lineage_statement_receipts: u64,
399 pub truncated: bool,
400}
401
402#[derive(Debug, Clone, Serialize, Deserialize)]
403#[serde(rename_all = "camelCase")]
404pub struct ChioOAuthAuthorizationReviewPackRecord {
405 pub receipt_id: String,
406 pub capability_id: String,
407 pub authorization_context: AuthorizationContextRow,
408 pub governed_transaction: GovernedTransactionReceiptMetadata,
409 #[serde(default, skip_serializing_if = "Option::is_none")]
410 pub governed_transaction_diagnostics: Option<GovernedTransactionDiagnostics>,
411 pub signed_receipt: ChioReceipt,
412}
413
414#[derive(Debug, Clone, Serialize, Deserialize)]
415#[serde(rename_all = "camelCase")]
416pub struct ChioOAuthAuthorizationReviewPack {
417 pub schema: String,
418 pub generated_at: u64,
419 pub filters: OperatorReportQuery,
420 pub metadata: ChioOAuthAuthorizationMetadataReport,
421 pub summary: ChioOAuthAuthorizationReviewPackSummary,
422 pub records: Vec<ChioOAuthAuthorizationReviewPackRecord>,
423}