Skip to main content

chio_kernel/operator_report/
authorization_context.rs

1use super::*;
2
3#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
4#[serde(rename_all = "camelCase")]
5pub struct GovernedAuthorizationCommerceDetail {
6    pub seller: String,
7    pub shared_payment_token_id: String,
8}
9
10#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
11#[serde(rename_all = "camelCase")]
12pub struct GovernedAuthorizationMeteredBillingDetail {
13    pub settlement_mode: MeteredSettlementMode,
14    pub provider: String,
15    pub quote_id: String,
16    pub billing_unit: String,
17    pub quoted_units: u64,
18    pub quoted_cost: MonetaryAmount,
19    #[serde(default, skip_serializing_if = "Option::is_none")]
20    pub max_billed_units: Option<u64>,
21}
22
23#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
24#[serde(rename_all = "camelCase")]
25pub struct GovernedAuthorizationDetail {
26    #[serde(rename = "type")]
27    pub detail_type: String,
28    #[serde(default, skip_serializing_if = "Vec::is_empty")]
29    pub locations: Vec<String>,
30    #[serde(default, skip_serializing_if = "Vec::is_empty")]
31    pub actions: Vec<String>,
32    #[serde(default, skip_serializing_if = "Option::is_none")]
33    pub purpose: Option<String>,
34    #[serde(default, skip_serializing_if = "Option::is_none")]
35    pub max_amount: Option<MonetaryAmount>,
36    #[serde(default, skip_serializing_if = "Option::is_none")]
37    pub commerce: Option<GovernedAuthorizationCommerceDetail>,
38    #[serde(default, skip_serializing_if = "Option::is_none")]
39    pub metered_billing: Option<GovernedAuthorizationMeteredBillingDetail>,
40}
41
42#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
43#[serde(rename_all = "camelCase")]
44pub struct GovernedAuthorizationTransactionContext {
45    pub intent_id: String,
46    pub intent_hash: String,
47    #[serde(default, skip_serializing_if = "Option::is_none")]
48    pub approval_token_id: Option<String>,
49    #[serde(default, skip_serializing_if = "Option::is_none")]
50    pub approval_approved: Option<bool>,
51    #[serde(default, skip_serializing_if = "Option::is_none")]
52    pub approver_key: Option<String>,
53    #[serde(default, skip_serializing_if = "Option::is_none")]
54    pub runtime_assurance_tier: Option<RuntimeAssuranceTier>,
55    #[serde(default, skip_serializing_if = "Option::is_none")]
56    pub runtime_assurance_schema: Option<String>,
57    #[serde(default, skip_serializing_if = "Option::is_none")]
58    pub runtime_assurance_verifier_family: Option<AttestationVerifierFamily>,
59    #[serde(default, skip_serializing_if = "Option::is_none")]
60    pub runtime_assurance_verifier: Option<String>,
61    #[serde(default, skip_serializing_if = "Option::is_none")]
62    pub runtime_assurance_evidence_sha256: Option<String>,
63    #[serde(default, skip_serializing_if = "Option::is_none")]
64    pub call_chain: Option<GovernedCallChainProvenance>,
65    #[serde(default, skip_serializing_if = "Option::is_none")]
66    pub identity_assertion: Option<ChioIdentityAssertion>,
67}
68
69#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
70#[serde(rename_all = "camelCase")]
71pub struct GovernedTransactionDiagnostics {
72    #[serde(default, skip_serializing_if = "Option::is_none")]
73    pub asserted_call_chain: Option<GovernedCallChainProvenance>,
74    #[serde(default, skip_serializing_if = "EvidenceLineageReferences::is_empty")]
75    pub lineage_references: EvidenceLineageReferences,
76}
77
78impl GovernedTransactionDiagnostics {
79    #[must_use]
80    pub fn is_empty(&self) -> bool {
81        self.asserted_call_chain.is_none() && self.lineage_references.is_empty()
82    }
83}
84
85fn default_authorization_context_report_schema() -> String {
86    CHIO_OAUTH_AUTHORIZATION_CONTEXT_REPORT_SCHEMA.to_string()
87}
88
89fn default_chio_oauth_authorization_profile() -> ChioOAuthAuthorizationProfile {
90    ChioOAuthAuthorizationProfile::default()
91}
92
93#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
94#[serde(rename_all = "camelCase")]
95pub struct ChioOAuthAuthorizationProfile {
96    pub schema: String,
97    pub id: String,
98    pub authoritative_source: String,
99    pub authorization_detail_types: Vec<String>,
100    pub transaction_context_fields: Vec<String>,
101    #[serde(default)]
102    pub portable_claim_catalog: ChioPortableClaimCatalog,
103    #[serde(default)]
104    pub portable_identity_binding: ChioPortableIdentityBinding,
105    #[serde(default)]
106    pub governed_auth_binding: ChioGovernedAuthorizationBinding,
107    #[serde(default)]
108    pub request_time_contract: ChioOAuthRequestTimeContract,
109    #[serde(default)]
110    pub resource_binding: ChioOAuthResourceBinding,
111    #[serde(default)]
112    pub artifact_boundary: ChioOAuthArtifactBoundary,
113    pub sender_constraints: ChioOAuthSenderConstraintProfile,
114    pub unsupported_shapes_fail_closed: bool,
115}
116
117#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
118#[serde(rename_all = "camelCase")]
119pub struct ChioOAuthRequestTimeContract {
120    pub authorization_details_parameter: String,
121    pub transaction_context_parameter: String,
122    pub access_token_authorization_details_claim: String,
123    pub access_token_transaction_context_claim: String,
124    pub request_time_authorization_details_supported: bool,
125    pub request_time_transaction_context_supported: bool,
126    pub governed_receipts_authoritative_post_execution: bool,
127}
128
129impl Default for ChioOAuthRequestTimeContract {
130    fn default() -> Self {
131        Self {
132            authorization_details_parameter:
133                CHIO_OAUTH_REQUEST_TIME_AUTHORIZATION_DETAILS_PARAMETER.to_string(),
134            transaction_context_parameter: CHIO_OAUTH_REQUEST_TIME_TRANSACTION_CONTEXT_PARAMETER
135                .to_string(),
136            access_token_authorization_details_claim:
137                CHIO_OAUTH_REQUEST_TIME_AUTHORIZATION_DETAILS_CLAIM.to_string(),
138            access_token_transaction_context_claim:
139                CHIO_OAUTH_REQUEST_TIME_TRANSACTION_CONTEXT_CLAIM.to_string(),
140            request_time_authorization_details_supported: true,
141            request_time_transaction_context_supported: true,
142            governed_receipts_authoritative_post_execution: true,
143        }
144    }
145}
146
147#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
148#[serde(rename_all = "camelCase")]
149pub struct ChioOAuthResourceBinding {
150    pub protected_resource_field: String,
151    pub request_resource_parameter: String,
152    pub access_token_audience_claim: String,
153    pub access_token_resource_claim: String,
154    pub request_resource_must_match_protected_resource: bool,
155    pub bearer_token_must_include_audience_or_resource: bool,
156}
157
158impl Default for ChioOAuthResourceBinding {
159    fn default() -> Self {
160        Self {
161            protected_resource_field: "resource".to_string(),
162            request_resource_parameter: "resource".to_string(),
163            access_token_audience_claim: "aud".to_string(),
164            access_token_resource_claim: "resource".to_string(),
165            request_resource_must_match_protected_resource: true,
166            bearer_token_must_include_audience_or_resource: true,
167        }
168    }
169}
170
171#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
172#[serde(rename_all = "camelCase")]
173pub struct ChioOAuthArtifactBoundary {
174    pub access_tokens_runtime_admission_supported: bool,
175    pub approval_tokens_runtime_admission_supported: bool,
176    pub capabilities_runtime_admission_supported: bool,
177    pub reviewer_evidence_runtime_admission_supported: bool,
178    pub governed_receipts_audit_evidence_supported: bool,
179}
180
181impl Default for ChioOAuthArtifactBoundary {
182    fn default() -> Self {
183        Self {
184            access_tokens_runtime_admission_supported: true,
185            approval_tokens_runtime_admission_supported: false,
186            capabilities_runtime_admission_supported: false,
187            reviewer_evidence_runtime_admission_supported: false,
188            governed_receipts_audit_evidence_supported: true,
189        }
190    }
191}
192
193#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
194#[serde(rename_all = "camelCase")]
195pub struct ChioOAuthSenderConstraintProfile {
196    pub schema: String,
197    pub subject_binding: String,
198    pub proof_types_supported: Vec<String>,
199    pub proof_required_when: String,
200    pub runtime_assurance_binding_fields: Vec<String>,
201    pub delegated_call_chain_field: String,
202    pub unsupported_sender_shapes_fail_closed: bool,
203}
204
205impl Default for ChioOAuthSenderConstraintProfile {
206    fn default() -> Self {
207        Self {
208            schema: CHIO_OAUTH_SENDER_CONSTRAINT_SCHEMA.to_string(),
209            subject_binding: CHIO_OAUTH_SENDER_BINDING_CAPABILITY_SUBJECT.to_string(),
210            proof_types_supported: vec![
211                CHIO_OAUTH_SENDER_PROOF_CHIO_DPOP.to_string(),
212                CHIO_OAUTH_SENDER_PROOF_CHIO_MTLS.to_string(),
213                CHIO_OAUTH_SENDER_PROOF_CHIO_ATTESTATION.to_string(),
214            ],
215            proof_required_when: "matchedGrant.dpopRequired == true".to_string(),
216            runtime_assurance_binding_fields: vec![
217                "runtimeAssuranceTier".to_string(),
218                "runtimeAssuranceSchema".to_string(),
219                "runtimeAssuranceVerifierFamily".to_string(),
220                "runtimeAssuranceVerifier".to_string(),
221                "runtimeAssuranceEvidenceSha256".to_string(),
222            ],
223            delegated_call_chain_field: "callChain".to_string(),
224            unsupported_sender_shapes_fail_closed: true,
225        }
226    }
227}
228
229impl Default for ChioOAuthAuthorizationProfile {
230    fn default() -> Self {
231        Self {
232            schema: CHIO_OAUTH_AUTHORIZATION_PROFILE_SCHEMA.to_string(),
233            id: CHIO_OAUTH_AUTHORIZATION_PROFILE_ID.to_string(),
234            authoritative_source: "governed_receipt_projection".to_string(),
235            authorization_detail_types: vec![
236                CHIO_OAUTH_AUTHORIZATION_TOOL_DETAIL_TYPE.to_string(),
237                CHIO_OAUTH_AUTHORIZATION_COMMERCE_DETAIL_TYPE.to_string(),
238                CHIO_OAUTH_AUTHORIZATION_METERED_BILLING_DETAIL_TYPE.to_string(),
239            ],
240            transaction_context_fields: vec![
241                "intentId".to_string(),
242                "intentHash".to_string(),
243                "approvalTokenId".to_string(),
244                "approvalApproved".to_string(),
245                "approverKey".to_string(),
246                "runtimeAssuranceTier".to_string(),
247                "runtimeAssuranceSchema".to_string(),
248                "runtimeAssuranceVerifierFamily".to_string(),
249                "runtimeAssuranceVerifier".to_string(),
250                "runtimeAssuranceEvidenceSha256".to_string(),
251                "callChain".to_string(),
252                "identityAssertion".to_string(),
253            ],
254            portable_claim_catalog: ChioPortableClaimCatalog::default(),
255            portable_identity_binding: ChioPortableIdentityBinding::default(),
256            governed_auth_binding: ChioGovernedAuthorizationBinding::default(),
257            request_time_contract: ChioOAuthRequestTimeContract::default(),
258            resource_binding: ChioOAuthResourceBinding::default(),
259            artifact_boundary: ChioOAuthArtifactBoundary::default(),
260            sender_constraints: ChioOAuthSenderConstraintProfile::default(),
261            unsupported_shapes_fail_closed: true,
262        }
263    }
264}
265
266#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
267#[serde(rename_all = "camelCase")]
268pub struct AuthorizationContextSummary {
269    pub matching_receipts: u64,
270    pub returned_receipts: u64,
271    pub approval_receipts: u64,
272    pub approved_receipts: u64,
273    pub commerce_receipts: u64,
274    pub metered_billing_receipts: u64,
275    pub runtime_assurance_receipts: u64,
276    pub call_chain_receipts: u64,
277    pub asserted_call_chain_receipts: u64,
278    pub observed_call_chain_receipts: u64,
279    pub verified_call_chain_receipts: u64,
280    pub max_amount_receipts: u64,
281    pub sender_bound_receipts: u64,
282    pub dpop_bound_receipts: u64,
283    pub runtime_assurance_bound_receipts: u64,
284    pub delegated_sender_bound_receipts: u64,
285    pub session_anchor_receipts: u64,
286    pub request_lineage_receipts: u64,
287    pub receipt_lineage_statement_receipts: u64,
288    pub truncated: bool,
289}
290
291#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
292#[serde(rename_all = "camelCase")]
293pub struct AuthorizationContextSenderConstraint {
294    pub subject_key: String,
295    pub subject_key_source: String,
296    #[serde(default, skip_serializing_if = "String::is_empty")]
297    pub issuer_key: String,
298    #[serde(default, skip_serializing_if = "String::is_empty")]
299    pub issuer_key_source: String,
300    pub matched_grant_index: u32,
301    pub proof_required: bool,
302    #[serde(default, skip_serializing_if = "Option::is_none")]
303    pub proof_type: Option<String>,
304    #[serde(default, skip_serializing_if = "Option::is_none")]
305    pub proof_schema: Option<String>,
306    pub runtime_assurance_bound: bool,
307    pub delegated_call_chain_bound: bool,
308}
309
310#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
311#[serde(rename_all = "camelCase")]
312pub struct AuthorizationContextRow {
313    pub receipt_id: String,
314    pub timestamp: u64,
315    pub capability_id: String,
316    #[serde(default, skip_serializing_if = "Option::is_none")]
317    pub subject_key: Option<String>,
318    pub tool_server: String,
319    pub tool_name: String,
320    #[serde(default, skip_serializing_if = "Option::is_none")]
321    pub decision: Option<Decision>,
322    pub authorization_details: Vec<GovernedAuthorizationDetail>,
323    pub transaction_context: GovernedAuthorizationTransactionContext,
324    #[serde(default, skip_serializing_if = "Option::is_none")]
325    pub governed_transaction_diagnostics: Option<GovernedTransactionDiagnostics>,
326    pub sender_constraint: AuthorizationContextSenderConstraint,
327}
328
329#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
330#[serde(rename_all = "camelCase")]
331pub struct AuthorizationContextReport {
332    #[serde(default = "default_authorization_context_report_schema")]
333    pub schema: String,
334    #[serde(default = "default_chio_oauth_authorization_profile")]
335    pub profile: ChioOAuthAuthorizationProfile,
336    pub summary: AuthorizationContextSummary,
337    pub receipts: Vec<AuthorizationContextRow>,
338}
339
340#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
341#[serde(rename_all = "camelCase")]
342pub struct ChioOAuthAuthorizationDiscoveryMetadata {
343    pub protected_resource_metadata_paths: Vec<String>,
344    pub authorization_server_metadata_path_template: String,
345    pub discovery_informational_only: bool,
346}
347
348#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
349#[serde(rename_all = "camelCase")]
350pub struct ChioOAuthAuthorizationSupportBoundary {
351    pub governed_receipts_authoritative: bool,
352    pub hosted_request_time_authorization_supported: bool,
353    pub resource_indicator_binding_supported: bool,
354    pub sender_constrained_projection: bool,
355    pub runtime_assurance_projection: bool,
356    pub delegated_call_chain_projection: bool,
357    pub generic_token_issuance_supported: bool,
358    pub oidc_identity_assertions_supported: bool,
359    pub mtls_transport_binding_in_profile: bool,
360    pub approval_tokens_runtime_authorization_supported: bool,
361    pub capabilities_runtime_authorization_supported: bool,
362    pub reviewer_evidence_runtime_authorization_supported: bool,
363}
364
365#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
366#[serde(rename_all = "camelCase")]
367pub struct ChioOAuthAuthorizationExampleMapping {
368    pub authorization_detail_types: Vec<String>,
369    pub transaction_context_fields: Vec<String>,
370    pub sender_constraint_fields: Vec<String>,
371}
372
373#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
374#[serde(rename_all = "camelCase")]
375pub struct ChioOAuthAuthorizationMetadataReport {
376    pub schema: String,
377    pub generated_at: u64,
378    pub profile: ChioOAuthAuthorizationProfile,
379    pub report_schema: String,
380    pub discovery: ChioOAuthAuthorizationDiscoveryMetadata,
381    pub support_boundary: ChioOAuthAuthorizationSupportBoundary,
382    pub example_mapping: ChioOAuthAuthorizationExampleMapping,
383}
384
385#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
386#[serde(rename_all = "camelCase")]
387pub struct ChioOAuthAuthorizationReviewPackSummary {
388    pub matching_receipts: u64,
389    pub returned_receipts: u64,
390    pub dpop_required_receipts: u64,
391    pub runtime_assurance_receipts: u64,
392    pub delegated_call_chain_receipts: u64,
393    pub asserted_call_chain_receipts: u64,
394    pub observed_call_chain_receipts: u64,
395    pub verified_call_chain_receipts: u64,
396    pub session_anchor_receipts: u64,
397    pub request_lineage_receipts: u64,
398    pub receipt_lineage_statement_receipts: u64,
399    pub truncated: bool,
400}
401
402#[derive(Debug, Clone, Serialize, Deserialize)]
403#[serde(rename_all = "camelCase")]
404pub struct ChioOAuthAuthorizationReviewPackRecord {
405    pub receipt_id: String,
406    pub capability_id: String,
407    pub authorization_context: AuthorizationContextRow,
408    pub governed_transaction: GovernedTransactionReceiptMetadata,
409    #[serde(default, skip_serializing_if = "Option::is_none")]
410    pub governed_transaction_diagnostics: Option<GovernedTransactionDiagnostics>,
411    pub signed_receipt: ChioReceipt,
412}
413
414#[derive(Debug, Clone, Serialize, Deserialize)]
415#[serde(rename_all = "camelCase")]
416pub struct ChioOAuthAuthorizationReviewPack {
417    pub schema: String,
418    pub generated_at: u64,
419    pub filters: OperatorReportQuery,
420    pub metadata: ChioOAuthAuthorizationMetadataReport,
421    pub summary: ChioOAuthAuthorizationReviewPackSummary,
422    pub records: Vec<ChioOAuthAuthorizationReviewPackRecord>,
423}