alibi-core 0.3.0

Shared authentication contracts and backend-independent services for Alibi
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

use crate::AuthError;
use indexmap::IndexMap;

/// Versioned persistence keys. New ciphertext uses the current version;
/// retained versions read existing ciphertext without rewriting it. Removing
/// a retained version retires it immediately. Signed cookies use only the
/// current key and are invalidated when that key changes.
#[derive(Clone)]
pub struct ManagedSecrets {
    current_version: u64,
    keys: IndexMap<u64, String>,
    legacy_secret: Option<String>,
}

impl ManagedSecrets {
    #[must_use]
    pub fn new(version: u64, secret: impl Into<String>) -> Self {
        Self {
            current_version: version,
            keys: IndexMap::from([(version, secret.into())]),
            legacy_secret: None,
        }
    }

    /// Retain a previous version for reads. Replacing the current version's
    /// key changes its key material; it does not change the selected version.
    #[must_use]
    pub fn retain(mut self, version: u64, secret: impl Into<String>) -> Self {
        _ = self.keys.insert(version, secret.into());
        self
    }

    /// Permit pre-managed bare ciphertext encrypted with this key.
    #[must_use]
    pub fn legacy(mut self, secret: impl Into<String>) -> Self {
        self.legacy_secret = Some(secret.into());
        self
    }

    /// Retire a reader. The current version cannot be retired; rotate by
    /// constructing a new configuration with a new current version instead.
    #[must_use]
    pub fn retire(mut self, version: u64) -> Self {
        if version != self.current_version {
            _ = self.keys.shift_remove(&version);
        }
        self
    }

    #[must_use]
    pub const fn current_version(&self) -> u64 {
        self.current_version
    }

    #[must_use]
    pub fn current_secret(&self) -> &str {
        self.key(self.current_version).unwrap_or_default()
    }

    #[must_use]
    pub fn key(&self, version: u64) -> Option<&str> {
        self.keys.get(&version).map(String::as_str)
    }

    #[must_use]
    pub fn legacy_secret(&self) -> Option<&str> {
        self.legacy_secret.as_deref()
    }

    pub fn verification_secrets(&self) -> impl Iterator<Item = &str> {
        self.keys.values().map(String::as_str).chain(
            self.legacy_secret
                .as_deref()
                .filter(|legacy| !self.keys.values().any(|key| key == legacy)),
        )
    }

    /// # Errors
    /// Rejects invalid versions, empty readers and an insecure current key.
    pub fn validate(&self) -> Result<(), AuthError> {
        if self
            .keys
            .iter()
            .any(|(version, key)| *version > 9_007_199_254_740_991 || key.is_empty())
        {
            return Err(AuthError::config(
                "Secret versions must be safe nonnegative integers with nonempty keys",
            ));
        }
        if self.current_secret().len() < 32 {
            return Err(AuthError::config(
                "Current secret key must be at least 32 characters",
            ));
        }
        if self.legacy_secret.as_deref().is_some_and(str::is_empty) {
            return Err(AuthError::config("Legacy secret key cannot be empty"));
        }
        Ok(())
    }
}

impl std::fmt::Debug for ManagedSecrets {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("ManagedSecrets")
            .field("current_version", &self.current_version)
            .field("versions", &self.keys.keys())
            .finish_non_exhaustive()
    }
}