iron-core 0.1.36

Core AgentIron loop, session state, and tool registry
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

use super::error::ConfigError;

/// Source for credential encryption keys.
pub trait KeySource: Send + Sync {
    /// Get the encryption key material.
    async fn get_key(&self) -> Result<[u8; 32], ConfigError>;
}

/// OS keyring-backed key source.
pub struct OsKeyringKeySource {
    service: String,
    account: String,
}

impl OsKeyringKeySource {
    pub fn new(service: impl Into<String>, account: impl Into<String>) -> Self {
        Self {
            service: service.into(),
            account: account.into(),
        }
    }
}

impl KeySource for OsKeyringKeySource {
    async fn get_key(&self) -> Result<[u8; 32], ConfigError> {
        let entry = keyring::Entry::new(&self.service, &self.account)
            .map_err(|e| ConfigError::KeyUnavailable(format!("Failed to access keyring: {}", e)))?;

        match entry.get_password() {
            Ok(password) => {
                let decoded = base64::Engine::decode(
                    &base64::engine::general_purpose::STANDARD,
                    &password,
                )
                .map_err(|e| ConfigError::InvalidKey(format!("Invalid key encoding: {}", e)))?;
                if decoded.len() != 32 {
                    return Err(ConfigError::InvalidKey("Key must be 32 bytes".to_string()));
                }
                let mut key = [0u8; 32];
                key.copy_from_slice(&decoded);
                Ok(key)
            }
            Err(keyring::Error::NoEntry) => {
                // Generate a new key
                let key = super::crypto::XChaCha20Poly1305Cipher::generate_key();
                let encoded =
                    base64::Engine::encode(&base64::engine::general_purpose::STANDARD, key);
                // Try to store; if another process already stored a key, read theirs
                if let Err(e) = entry.set_password(&encoded) {
                    // Another process may have won the race; read what they stored
                    if let Ok(password) = entry.get_password() {
                        let decoded = base64::Engine::decode(
                            &base64::engine::general_purpose::STANDARD,
                            &password,
                        )
                        .map_err(|e| {
                            ConfigError::InvalidKey(format!("Invalid key encoding: {}", e))
                        })?;
                        if decoded.len() != 32 {
                            return Err(ConfigError::InvalidKey(
                                "Key must be 32 bytes".to_string(),
                            ));
                        }
                        let mut peer_key = [0u8; 32];
                        peer_key.copy_from_slice(&decoded);
                        return Ok(peer_key);
                    }
                    return Err(ConfigError::KeyUnavailable(format!(
                        "Failed to store key: {}",
                        e
                    )));
                }
                Ok(key)
            }
            Err(e) => Err(ConfigError::KeyUnavailable(format!("Keyring error: {}", e))),
        }
    }
}

/// Environment variable key source.
pub struct EnvVarKeySource {
    var_name: String,
}

impl EnvVarKeySource {
    pub fn new(var_name: impl Into<String>) -> Self {
        Self {
            var_name: var_name.into(),
        }
    }
}

impl KeySource for EnvVarKeySource {
    async fn get_key(&self) -> Result<[u8; 32], ConfigError> {
        let value = std::env::var(&self.var_name).map_err(|_| {
            ConfigError::KeyUnavailable(format!("Environment variable {} not set", self.var_name))
        })?;

        let decoded = base64::Engine::decode(&base64::engine::general_purpose::STANDARD, &value)
            .map_err(|e| ConfigError::InvalidKey(format!("Invalid base64: {}", e)))?;

        if decoded.len() != 32 {
            return Err(ConfigError::InvalidKey("Key must be 32 bytes".to_string()));
        }

        let mut key = [0u8; 32];
        key.copy_from_slice(&decoded);
        Ok(key)
    }
}

/// Static key source for testing.
pub struct StaticKeySource {
    key: [u8; 32],
}

impl StaticKeySource {
    pub fn new(key: [u8; 32]) -> Self {
        Self { key }
    }
}

impl KeySource for StaticKeySource {
    async fn get_key(&self) -> Result<[u8; 32], ConfigError> {
        Ok(self.key)
    }
}