canic-core 0.100.76

Canic — a canister orchestration and management toolkit for the Internet Computer
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

//! Module: ops::auth::crypto
//!
//! Responsibility: encode and hash auth payloads with stable domain separation.
//! Does not own: proof verification, storage, or endpoint authorization.
//! Boundary: private auth helper for canonical payload hashing.

use super::ROLE_ATTESTATION_PROOF_HASH_DOMAIN;
use crate::{InternalError, dto::auth::RoleAttestation, ops::auth::AuthValidationError};
use candid::encode_one;
use sha2::{Digest, Sha256};

pub(super) fn role_attestation_hash(
    attestation: &RoleAttestation,
) -> Result<[u8; 32], InternalError> {
    let payload = encode_one(attestation).map_err(|err| AuthValidationError::EncodeFailed {
        context: "role attestation",
        source: err,
    })?;
    Ok(domain_separated_hash(
        ROLE_ATTESTATION_PROOF_HASH_DOMAIN,
        payload,
    ))
}

fn domain_separated_hash(domain: &[u8], payload: Vec<u8>) -> [u8; 32] {
    let mut hasher = Sha256::new();
    hasher.update(domain);
    hasher.update(payload);
    hasher.finalize().into()
}