canic-core 0.111.0

Canic — a canister orchestration and management toolkit for the Internet Computer
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

//! Module: access::caller_authority
//!
//! Local managed-caller admission at authenticated endpoint and subsequent effect boundaries.

use crate::{
    access::AccessError,
    ops::{config::ConfigOps, ic::IcOps},
    workflow::caller_authority::admission::CallerAdmissionWorkflow,
};

pub use crate::domain::policy::pure::caller_authority::{
    CallerAdmissionTicket, CallerTargetTicket,
};
pub use crate::model::caller_authority::CallerAdmissionError;

/// Admit the IC transport caller for a named compiled permission without a remote lookup.
pub fn admit(permission: &str) -> Result<CallerAdmissionTicket, AccessError> {
    ConfigOps::with_caller_policy(|policy| {
        CallerAdmissionWorkflow::admit(IcOps::msg_caller(), permission, policy)
    })
    .map_err(AccessError::Internal)?
    .map_err(AccessError::CallerAuthority)
}

/// Require the original ticket to remain valid before issuing the next new protected effect.
pub fn revalidate(ticket: &CallerAdmissionTicket) -> Result<(), AccessError> {
    ConfigOps::with_caller_policy(|policy| CallerAdmissionWorkflow::revalidate(ticket, policy))
        .map_err(AccessError::Internal)?
        .map_err(AccessError::CallerAuthority)
}

/// Select a permitted proxy destination; separately authenticate the incoming application subject.
pub fn select_target(
    target: candid::Principal,
    permission: &str,
) -> Result<CallerTargetTicket, AccessError> {
    ConfigOps::with_caller_policy(|policy| {
        CallerAdmissionWorkflow::select_target(target, permission, policy)
    })
    .map_err(AccessError::Internal)?
    .map_err(AccessError::CallerAuthority)
}

/// Recheck the retained destination before issuing a new remote effect after an await.
pub fn revalidate_target(ticket: &CallerTargetTicket) -> Result<(), AccessError> {
    ConfigOps::with_caller_policy(|policy| {
        CallerAdmissionWorkflow::revalidate_target(ticket, policy)
    })
    .map_err(AccessError::Internal)?
    .map_err(AccessError::CallerAuthority)
}