agent-workspace-contract 0.7.0

//! Resource-manager authorization for a bounded cross-tenant application execution.
use super::*;

pub const APPLICATION_EXECUTIONS_PATH: &str =
    "/internal/v1/workspace/computers/{computerId}/application-executions";
pub const APPLICATION_COMMAND_CONTEXTS_PATH: &str =
    "/internal/v1/workspace/computers/{computerId}/application-command-contexts";
pub const APPLICATION_EXECUTION_HEADER: &str = "x-workspace-application-execution";
pub const APPLICATION_AGENT_HEADER: &str = "x-workspace-execution-agent";
pub const APPLICATION_CALLER_HEADER: &str = "x-workspace-caller-authorization";
pub const APPLICATION_EXECUTION_MAX_TTL_MS: u64 = 24 * 60 * 60 * 1000;

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields, rename_all = "camelCase")]
pub struct CreateApplicationExecutionRequest {
    pub app_id: String,
    pub space_id: String,
    pub agent_id: String,
    pub runtime_id: String,
    pub ttl_ms: u64,
}

/// This handle is usable only by its verified Runtime for the selected Agent.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields, rename_all = "camelCase")]
pub struct ApplicationExecutionResource {
    pub id: String,
    pub app_id: String,
    pub computer_id: String,
    pub space_id: String,
    pub agent_id: String,
    pub runtime_id: String,
    pub grant_id: String,
    pub grant_version: u64,
    pub expires_at_ms: u64,
}

/// Internal authenticated context, never accepted from a JSON body or JWT claim.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct VerifiedApplicationExecution {
    #[serde(default)]
    pub runtime_scope: Option<ResourceScope>,
    pub resource: ApplicationExecutionResource,
    pub scope: ResourceScope,
    pub caller_user_id: String,
}
impl VerifiedApplicationExecution {
    pub fn principal(&self) -> PrincipalRef {
        PrincipalRef::agent(format!("application:{}", self.resource.id))
    }
}