ic-auth-protocol-types 0.6.1

Passive application authentication protocol contracts
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107

//! Generate data contracts from their Rust owner; this declares no endpoints.
use candid::{Decode, Encode, pretty::candid::compile, types::internal::TypeContainer};
use ic_auth_protocol_types::{
    AudienceId, AuthRequestMetadata, CanonicalId, DelegatedRoleGrant, DelegatedToken,
    DelegatedTokenGetRequest, DelegatedTokenPrepareRequest, DelegatedTokenPrepareResponse,
    DelegationAudience, LogoutRequest, LogoutResult, LogoutUnavailable, PortableCredential,
    PortableProof,
};

fn request_vector() -> DelegatedTokenPrepareRequest {
    DelegatedTokenPrepareRequest {
        metadata: Some(AuthRequestMetadata {
            request_id: [7; 32],
            ttl_ns: 1_000_000_000,
        }),
        aud: DelegationAudience::Fleet(AudienceId {
            canonical_network_id: CanonicalId::from_bytes([0xaa; 32]),
            fleet_id: CanonicalId::from_bytes([0xbb; 32]),
        }),
        grants: vec![DelegatedRoleGrant {
            target: "users".parse().expect("canonical role"),
            scopes: vec!["read".into()],
        }],
        ttl_ns: 9_007_199_254_740_993,
        ext: Some(vec![0, 255]),
    }
}

// Deliberately opaque transport bytes, not a valid signed credential.
fn credential_vector() -> PortableCredential {
    PortableCredential {
        claims: vec![0, 1, 127, 128, 255],
        proof: PortableProof::Ed25519 {
            signature: (0..64).collect(),
        },
    }
}

fn logout_vector() -> Vec<LogoutResult> {
    vec![
        LogoutResult::Revoked {
            deny_until_ns: 9_007_199_254_740_993,
        },
        LogoutResult::InvalidCaller,
        LogoutResult::Unavailable(LogoutUnavailable::Capacity),
        LogoutResult::Unavailable(LogoutUnavailable::Storage),
        LogoutResult::Unavailable(LogoutUnavailable::Clock),
        LogoutResult::Unavailable(LogoutUnavailable::ResetPending),
    ]
}

fn main() {
    let arguments: Vec<_> = std::env::args().skip(1).collect();
    match arguments.as_slice() {
        [] => {
            let mut types = TypeContainer::new();
            types.add::<DelegatedToken>();
            types.add::<PortableCredential>();
            // Candid elides names for empty records; retain the public request alias.
            let logout_request = types.add::<LogoutRequest>();
            types.env.0.insert("LogoutRequest".into(), logout_request);
            types.add::<LogoutResult>();
            types.add::<DelegatedTokenGetRequest>();
            types.add::<DelegatedTokenPrepareRequest>();
            types.add::<DelegatedTokenPrepareResponse>();
            print!("{}", compile(&types.env, &None));
        }
        [mode] if mode == "--request-vector" => {
            for byte in Encode!(&request_vector()).expect("encode fixture") {
                print!("{byte:02x}");
            }
            println!();
        }
        [mode, path] if mode == "--check-request" => {
            let bytes = std::fs::read(path).expect("read TS fixture");
            let actual = Decode!(&bytes, DelegatedTokenPrepareRequest).expect("decode TS fixture");
            assert_eq!(actual, request_vector());
        }
        [mode] if mode == "--credential-vector" => {
            for byte in Encode!(&credential_vector()).expect("encode credential fixture") {
                print!("{byte:02x}");
            }
            println!();
        }
        [mode, path] if mode == "--check-credential" => {
            let bytes = std::fs::read(path).expect("read TS credential fixture");
            let actual = Decode!(&bytes, PortableCredential).expect("decode TS credential fixture");
            assert_eq!(actual, credential_vector());
        }
        [mode] if mode == "--logout-vector" => {
            for byte in Encode!(&logout_vector()).expect("encode logout fixture") {
                print!("{byte:02x}");
            }
            println!();
        }
        [mode, path] if mode == "--check-logout" => {
            let bytes = std::fs::read(path).expect("read TS logout fixture");
            assert_eq!(
                Decode!(&bytes, Vec<LogoutResult>).expect("decode TS logout fixture"),
                logout_vector()
            );
        }
        _ => panic!(
            "usage: export_candid [--request-vector | --check-request PATH | --credential-vector | --check-credential PATH | --logout-vector | --check-logout PATH]"
        ),
    }
}