iicp-client 0.7.93

Use the open IICP AI mesh from Rust without running a node
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

// SPDX-License-Identifier: Apache-2.0
//! Production-identity projection policy for opt-in lifecycle operations.

use serde_json::Value;

const ALLOWED_AUDIT: [&str; 9] = [
    "event_id",
    "task_ref",
    "principal_ref_digest",
    "credential_key_id",
    "revocation_epoch",
    "operation",
    "outcome",
    "reason_code",
    "occurred_at",
];

pub fn evaluate_lifecycle_identity(input: &Value, retention_seconds: i64) -> &'static str {
    if input["kind"] == "audit_retention" {
        return if input["age_seconds"].as_i64().unwrap_or(0) > retention_seconds {
            "audit_record_pruned"
        } else {
            "audit_record_retained"
        };
    }
    if input["kind"] == "audit_redaction" {
        let allowed = input["audit"].as_object().is_some_and(|audit| {
            audit
                .keys()
                .all(|field| ALLOWED_AUDIT.contains(&field.as_str()))
        });
        return if allowed {
            "audit_record_allowed"
        } else {
            "reject_before_write"
        };
    }
    if input["profile_requested"] != true && input["surface"] == "ordinary_task" {
        return "legacy_open_mesh_unchanged";
    }
    if input["credential_status"] != "valid" {
        return "unauthenticated";
    }
    if input["credential_revocation_epoch"].as_i64().unwrap_or(0)
        < input["minimum_revocation_epoch"].as_i64().unwrap_or(0)
    {
        return "unauthenticated";
    }
    let operation = input["operation"].as_str().unwrap_or("");
    let scopes = input["scope"].as_array().cloned().unwrap_or_default();
    let has_scope = |scope: &str| scopes.iter().any(|item| item == scope);
    if operation == "submit" {
        return if has_scope("submit") {
            "allowed_bind_owner"
        } else {
            "forbidden"
        };
    }
    if input["principal_ref_digest"] != input["task_owner_ref_digest"] {
        let operator_scope = format!("operator:{operation}");
        if input["operator_override"] == true && has_scope(&operator_scope) {
            return "allowed_operator_override";
        }
        return "concealed_task";
    }
    if has_scope(operation) {
        "allowed"
    } else {
        "forbidden"
    }
}