ic_auth_wire/
lib.rs

1//! Controlled portable-session transport. No endpoint installation, authority,
2//! cryptography, session storage or delivery/retry policy is supplied here.
3pub mod model;
4use ic_auth_protocol_types::limits::{MAX_LABEL_BYTES, MAX_SESSION_SCOPES};
5pub use ic_wire as wire;
6use ic_wire::{Limits, List, Text};
7use model::{LogoutResult, PortableCredential};
8
9/// Admission narrowing accompanies the exact opaque signed credential.
10#[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize)]
11#[cfg_attr(feature = "typescript", derive(ic_wire::Wire))]
12pub struct SessionInput {
13    pub credential: PortableCredential,
14    pub scopes: List<Text<MAX_LABEL_BYTES>, MAX_SESSION_SCOPES>,
15    pub ttl_secs: Option<u64>,
16}
17/// A receiver's authenticated local reply, never a transferable authorization.
18#[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize)]
19#[cfg_attr(feature = "typescript", derive(ic_wire::Wire))]
20pub struct SessionView {
21    pub caller: ic_wire::Bytes<29>,
22    pub issuer: ic_wire::Bytes<29>,
23    pub subject: ic_wire::Bytes<29>,
24    pub expires_at_ns: u64,
25}
26const CREDENTIAL_LIMITS: Limits = Limits {
27    bytes: 524288,
28    allocation: 2097152,
29    nodes: 65536,
30    depth: 32,
31};
32const REPLY_LIMITS: Limits = Limits {
33    bytes: 4096,
34    allocation: 16384,
35    nodes: 128,
36    depth: 8,
37};
38const EMPTY_LIMITS: Limits = Limits {
39    bytes: 11,
40    allocation: 128,
41    nodes: 8,
42    depth: 4,
43};
44
45// Keep method identities and limits explicit; only the four native codec
46// forwarders are mechanical. This macro is private and emits the existing API.
47macro_rules! codecs {
48    ($request:ty, $response:ty) => {
49        pub fn encode_request(value: &$request) -> Result<Vec<u8>, ic_wire::Error> {
50            ic_wire::native::encode_request(Self::ID, value, Self::REQUEST_LIMITS)
51        }
52        pub fn decode_request(bytes: &[u8]) -> Result<$request, ic_wire::Error> {
53            ic_wire::native::decode_request(Self::ID, bytes, Self::REQUEST_LIMITS)
54        }
55        pub fn encode_response(value: &$response) -> Result<Vec<u8>, ic_wire::Error> {
56            ic_wire::native::encode_response(Self::ID, value, Self::RESPONSE_LIMITS)
57        }
58        pub fn decode_response(bytes: &[u8]) -> Result<$response, ic_wire::Error> {
59            ic_wire::native::decode_response(Self::ID, bytes, Self::RESPONSE_LIMITS)
60        }
61    };
62}
63
64/// Data-envelope identity, not a callable issuer method or signing format.
65pub struct CredentialEnvelope;
66impl CredentialEnvelope {
67    pub const ID: u64 = 0x415554480001;
68    pub const NAME: &'static str = "credential";
69    pub const REQUEST_LIMITS: Limits = CREDENTIAL_LIMITS;
70    pub const RESPONSE_LIMITS: Limits = CREDENTIAL_LIMITS;
71    codecs!(PortableCredential, PortableCredential);
72}
73/// Controlled admission contract; consumers bind it to their own update export.
74pub struct EstablishSession;
75impl EstablishSession {
76    pub const ID: u64 = 0x415554480012;
77    pub const NAME: &'static str = "establish_portable_session";
78    pub const REQUEST_LIMITS: Limits = CREDENTIAL_LIMITS;
79    pub const RESPONSE_LIMITS: Limits = REPLY_LIMITS;
80    codecs!(SessionInput, Result<SessionView, model::AdmissionRefusal>);
81}
82/// Proof-free local read contract; the runtime caller selects the session.
83pub struct ReadSession;
84impl ReadSession {
85    pub const ID: u64 = 0x415554480003;
86    pub const NAME: &'static str = "portable_session_read";
87    pub const REQUEST_LIMITS: Limits = EMPTY_LIMITS;
88    pub const RESPONSE_LIMITS: Limits = REPLY_LIMITS;
89    codecs!((), Result<SessionView, Text<256>>);
90}
91/// Caller-authenticated logout; no submitted proof or caller identity is trusted.
92pub struct Logout;
93impl Logout {
94    pub const ID: u64 = 0x415554480004;
95    pub const NAME: &'static str = "logout_portable_session";
96    pub const REQUEST_LIMITS: Limits = EMPTY_LIMITS;
97    pub const RESPONSE_LIMITS: Limits = REPLY_LIMITS;
98    codecs!((), LogoutResult);
99}
ic_auth_wire/lib.rs

ic_auth_wire/
lib.rs
