chio-kernel 0.1.2

Chio runtime kernel: capability validation, guard evaluation, receipt signing
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
use super::*;

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct GovernedAuthorizationCommerceDetail {
    pub seller: String,
    pub shared_payment_token_id: String,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct GovernedAuthorizationMeteredBillingDetail {
    pub settlement_mode: MeteredSettlementMode,
    pub provider: String,
    pub quote_id: String,
    pub billing_unit: String,
    pub quoted_units: u64,
    pub quoted_cost: MonetaryAmount,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub max_billed_units: Option<u64>,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct GovernedAuthorizationDetail {
    #[serde(rename = "type")]
    pub detail_type: String,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub locations: Vec<String>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub actions: Vec<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub purpose: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub max_amount: Option<MonetaryAmount>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub commerce: Option<GovernedAuthorizationCommerceDetail>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub metered_billing: Option<GovernedAuthorizationMeteredBillingDetail>,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct GovernedAuthorizationTransactionContext {
    pub intent_id: String,
    pub intent_hash: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub approval_token_id: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub approval_approved: Option<bool>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub approver_key: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub runtime_assurance_tier: Option<RuntimeAssuranceTier>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub runtime_assurance_schema: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub runtime_assurance_verifier_family: Option<AttestationVerifierFamily>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub runtime_assurance_verifier: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub runtime_assurance_evidence_sha256: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub call_chain: Option<GovernedCallChainProvenance>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub identity_assertion: Option<ChioIdentityAssertion>,
}

#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct GovernedTransactionDiagnostics {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub asserted_call_chain: Option<GovernedCallChainProvenance>,
    #[serde(default, skip_serializing_if = "EvidenceLineageReferences::is_empty")]
    pub lineage_references: EvidenceLineageReferences,
}

impl GovernedTransactionDiagnostics {
    #[must_use]
    pub fn is_empty(&self) -> bool {
        self.asserted_call_chain.is_none() && self.lineage_references.is_empty()
    }
}

fn default_authorization_context_report_schema() -> String {
    CHIO_OAUTH_AUTHORIZATION_CONTEXT_REPORT_SCHEMA.to_string()
}

fn default_chio_oauth_authorization_profile() -> ChioOAuthAuthorizationProfile {
    ChioOAuthAuthorizationProfile::default()
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthAuthorizationProfile {
    pub schema: String,
    pub id: String,
    pub authoritative_source: String,
    pub authorization_detail_types: Vec<String>,
    pub transaction_context_fields: Vec<String>,
    #[serde(default)]
    pub portable_claim_catalog: ChioPortableClaimCatalog,
    #[serde(default)]
    pub portable_identity_binding: ChioPortableIdentityBinding,
    #[serde(default)]
    pub governed_auth_binding: ChioGovernedAuthorizationBinding,
    #[serde(default)]
    pub request_time_contract: ChioOAuthRequestTimeContract,
    #[serde(default)]
    pub resource_binding: ChioOAuthResourceBinding,
    #[serde(default)]
    pub artifact_boundary: ChioOAuthArtifactBoundary,
    pub sender_constraints: ChioOAuthSenderConstraintProfile,
    pub unsupported_shapes_fail_closed: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthRequestTimeContract {
    pub authorization_details_parameter: String,
    pub transaction_context_parameter: String,
    pub access_token_authorization_details_claim: String,
    pub access_token_transaction_context_claim: String,
    pub request_time_authorization_details_supported: bool,
    pub request_time_transaction_context_supported: bool,
    pub governed_receipts_authoritative_post_execution: bool,
}

impl Default for ChioOAuthRequestTimeContract {
    fn default() -> Self {
        Self {
            authorization_details_parameter:
                CHIO_OAUTH_REQUEST_TIME_AUTHORIZATION_DETAILS_PARAMETER.to_string(),
            transaction_context_parameter: CHIO_OAUTH_REQUEST_TIME_TRANSACTION_CONTEXT_PARAMETER
                .to_string(),
            access_token_authorization_details_claim:
                CHIO_OAUTH_REQUEST_TIME_AUTHORIZATION_DETAILS_CLAIM.to_string(),
            access_token_transaction_context_claim:
                CHIO_OAUTH_REQUEST_TIME_TRANSACTION_CONTEXT_CLAIM.to_string(),
            request_time_authorization_details_supported: true,
            request_time_transaction_context_supported: true,
            governed_receipts_authoritative_post_execution: true,
        }
    }
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthResourceBinding {
    pub protected_resource_field: String,
    pub request_resource_parameter: String,
    pub access_token_audience_claim: String,
    pub access_token_resource_claim: String,
    pub request_resource_must_match_protected_resource: bool,
    pub bearer_token_must_include_audience_or_resource: bool,
}

impl Default for ChioOAuthResourceBinding {
    fn default() -> Self {
        Self {
            protected_resource_field: "resource".to_string(),
            request_resource_parameter: "resource".to_string(),
            access_token_audience_claim: "aud".to_string(),
            access_token_resource_claim: "resource".to_string(),
            request_resource_must_match_protected_resource: true,
            bearer_token_must_include_audience_or_resource: true,
        }
    }
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthArtifactBoundary {
    pub access_tokens_runtime_admission_supported: bool,
    pub approval_tokens_runtime_admission_supported: bool,
    pub capabilities_runtime_admission_supported: bool,
    pub reviewer_evidence_runtime_admission_supported: bool,
    pub governed_receipts_audit_evidence_supported: bool,
}

impl Default for ChioOAuthArtifactBoundary {
    fn default() -> Self {
        Self {
            access_tokens_runtime_admission_supported: true,
            approval_tokens_runtime_admission_supported: false,
            capabilities_runtime_admission_supported: false,
            reviewer_evidence_runtime_admission_supported: false,
            governed_receipts_audit_evidence_supported: true,
        }
    }
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthSenderConstraintProfile {
    pub schema: String,
    pub subject_binding: String,
    pub proof_types_supported: Vec<String>,
    pub proof_required_when: String,
    pub runtime_assurance_binding_fields: Vec<String>,
    pub delegated_call_chain_field: String,
    pub unsupported_sender_shapes_fail_closed: bool,
}

impl Default for ChioOAuthSenderConstraintProfile {
    fn default() -> Self {
        Self {
            schema: CHIO_OAUTH_SENDER_CONSTRAINT_SCHEMA.to_string(),
            subject_binding: CHIO_OAUTH_SENDER_BINDING_CAPABILITY_SUBJECT.to_string(),
            proof_types_supported: vec![
                CHIO_OAUTH_SENDER_PROOF_CHIO_DPOP.to_string(),
                CHIO_OAUTH_SENDER_PROOF_CHIO_MTLS.to_string(),
                CHIO_OAUTH_SENDER_PROOF_CHIO_ATTESTATION.to_string(),
            ],
            proof_required_when: "matchedGrant.dpopRequired == true".to_string(),
            runtime_assurance_binding_fields: vec![
                "runtimeAssuranceTier".to_string(),
                "runtimeAssuranceSchema".to_string(),
                "runtimeAssuranceVerifierFamily".to_string(),
                "runtimeAssuranceVerifier".to_string(),
                "runtimeAssuranceEvidenceSha256".to_string(),
            ],
            delegated_call_chain_field: "callChain".to_string(),
            unsupported_sender_shapes_fail_closed: true,
        }
    }
}

impl Default for ChioOAuthAuthorizationProfile {
    fn default() -> Self {
        Self {
            schema: CHIO_OAUTH_AUTHORIZATION_PROFILE_SCHEMA.to_string(),
            id: CHIO_OAUTH_AUTHORIZATION_PROFILE_ID.to_string(),
            authoritative_source: "governed_receipt_projection".to_string(),
            authorization_detail_types: vec![
                CHIO_OAUTH_AUTHORIZATION_TOOL_DETAIL_TYPE.to_string(),
                CHIO_OAUTH_AUTHORIZATION_COMMERCE_DETAIL_TYPE.to_string(),
                CHIO_OAUTH_AUTHORIZATION_METERED_BILLING_DETAIL_TYPE.to_string(),
            ],
            transaction_context_fields: vec![
                "intentId".to_string(),
                "intentHash".to_string(),
                "approvalTokenId".to_string(),
                "approvalApproved".to_string(),
                "approverKey".to_string(),
                "runtimeAssuranceTier".to_string(),
                "runtimeAssuranceSchema".to_string(),
                "runtimeAssuranceVerifierFamily".to_string(),
                "runtimeAssuranceVerifier".to_string(),
                "runtimeAssuranceEvidenceSha256".to_string(),
                "callChain".to_string(),
                "identityAssertion".to_string(),
            ],
            portable_claim_catalog: ChioPortableClaimCatalog::default(),
            portable_identity_binding: ChioPortableIdentityBinding::default(),
            governed_auth_binding: ChioGovernedAuthorizationBinding::default(),
            request_time_contract: ChioOAuthRequestTimeContract::default(),
            resource_binding: ChioOAuthResourceBinding::default(),
            artifact_boundary: ChioOAuthArtifactBoundary::default(),
            sender_constraints: ChioOAuthSenderConstraintProfile::default(),
            unsupported_shapes_fail_closed: true,
        }
    }
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct AuthorizationContextSummary {
    pub matching_receipts: u64,
    pub returned_receipts: u64,
    pub approval_receipts: u64,
    pub approved_receipts: u64,
    pub commerce_receipts: u64,
    pub metered_billing_receipts: u64,
    pub runtime_assurance_receipts: u64,
    pub call_chain_receipts: u64,
    pub asserted_call_chain_receipts: u64,
    pub observed_call_chain_receipts: u64,
    pub verified_call_chain_receipts: u64,
    pub max_amount_receipts: u64,
    pub sender_bound_receipts: u64,
    pub dpop_bound_receipts: u64,
    pub runtime_assurance_bound_receipts: u64,
    pub delegated_sender_bound_receipts: u64,
    pub session_anchor_receipts: u64,
    pub request_lineage_receipts: u64,
    pub receipt_lineage_statement_receipts: u64,
    pub truncated: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct AuthorizationContextSenderConstraint {
    pub subject_key: String,
    pub subject_key_source: String,
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub issuer_key: String,
    #[serde(default, skip_serializing_if = "String::is_empty")]
    pub issuer_key_source: String,
    pub matched_grant_index: u32,
    pub proof_required: bool,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub proof_type: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub proof_schema: Option<String>,
    pub runtime_assurance_bound: bool,
    pub delegated_call_chain_bound: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct AuthorizationContextRow {
    pub receipt_id: String,
    pub timestamp: u64,
    pub capability_id: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub subject_key: Option<String>,
    pub tool_server: String,
    pub tool_name: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub decision: Option<Decision>,
    pub authorization_details: Vec<GovernedAuthorizationDetail>,
    pub transaction_context: GovernedAuthorizationTransactionContext,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub governed_transaction_diagnostics: Option<GovernedTransactionDiagnostics>,
    pub sender_constraint: AuthorizationContextSenderConstraint,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct AuthorizationContextReport {
    #[serde(default = "default_authorization_context_report_schema")]
    pub schema: String,
    #[serde(default = "default_chio_oauth_authorization_profile")]
    pub profile: ChioOAuthAuthorizationProfile,
    pub summary: AuthorizationContextSummary,
    pub receipts: Vec<AuthorizationContextRow>,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthAuthorizationDiscoveryMetadata {
    pub protected_resource_metadata_paths: Vec<String>,
    pub authorization_server_metadata_path_template: String,
    pub discovery_informational_only: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthAuthorizationSupportBoundary {
    pub governed_receipts_authoritative: bool,
    pub hosted_request_time_authorization_supported: bool,
    pub resource_indicator_binding_supported: bool,
    pub sender_constrained_projection: bool,
    pub runtime_assurance_projection: bool,
    pub delegated_call_chain_projection: bool,
    pub generic_token_issuance_supported: bool,
    pub oidc_identity_assertions_supported: bool,
    pub mtls_transport_binding_in_profile: bool,
    pub approval_tokens_runtime_authorization_supported: bool,
    pub capabilities_runtime_authorization_supported: bool,
    pub reviewer_evidence_runtime_authorization_supported: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthAuthorizationExampleMapping {
    pub authorization_detail_types: Vec<String>,
    pub transaction_context_fields: Vec<String>,
    pub sender_constraint_fields: Vec<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthAuthorizationMetadataReport {
    pub schema: String,
    pub generated_at: u64,
    pub profile: ChioOAuthAuthorizationProfile,
    pub report_schema: String,
    pub discovery: ChioOAuthAuthorizationDiscoveryMetadata,
    pub support_boundary: ChioOAuthAuthorizationSupportBoundary,
    pub example_mapping: ChioOAuthAuthorizationExampleMapping,
}

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthAuthorizationReviewPackSummary {
    pub matching_receipts: u64,
    pub returned_receipts: u64,
    pub dpop_required_receipts: u64,
    pub runtime_assurance_receipts: u64,
    pub delegated_call_chain_receipts: u64,
    pub asserted_call_chain_receipts: u64,
    pub observed_call_chain_receipts: u64,
    pub verified_call_chain_receipts: u64,
    pub session_anchor_receipts: u64,
    pub request_lineage_receipts: u64,
    pub receipt_lineage_statement_receipts: u64,
    pub truncated: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthAuthorizationReviewPackRecord {
    pub receipt_id: String,
    pub capability_id: String,
    pub authorization_context: AuthorizationContextRow,
    pub governed_transaction: GovernedTransactionReceiptMetadata,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub governed_transaction_diagnostics: Option<GovernedTransactionDiagnostics>,
    pub signed_receipt: ChioReceipt,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct ChioOAuthAuthorizationReviewPack {
    pub schema: String,
    pub generated_at: u64,
    pub filters: OperatorReportQuery,
    pub metadata: ChioOAuthAuthorizationMetadataReport,
    pub summary: ChioOAuthAuthorizationReviewPackSummary,
    pub records: Vec<ChioOAuthAuthorizationReviewPackRecord>,
}