liminal-server 0.25.4

Standalone server for the liminal messaging bus
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

//! A signed MCP read observes the presented certificate's exact current record.

use super::CertificateRefusal;
use serde_json::Value;

/// The existing read tool relays the agent's own certificate route unchanged.
///
/// # Errors
/// A holder that cannot be one route segment or a JSON encoding refusal.
pub fn request(holder: &str) -> Result<Vec<u8>, CertificateRefusal> {
    if holder.is_empty()
        || !holder
            .bytes()
            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_'))
    {
        return Err(CertificateRefusal::HolderMismatch);
    }
    serde_json::to_vec(&serde_json::json!({"jsonrpc":"2.0", "id":1, "method":"tools/call",
        "params":{"name":"read", "arguments":{"method":"GET", "path":format!("/agents/{holder}/certificates")}}}))
        .map_err(|_| CertificateRefusal::StatusUnavailable)
}

/// Selects the exact DER, rather than accepting any standing certificate for its key.
/// This is a current authenticated issuer observation, not a signed log root.
///
/// # Errors
/// Foreign holder, absent/duplicated/unreadable record or exact withdrawal.
pub fn verify_view(view: &Value, holder: &str, der: &[u8]) -> Result<(), CertificateRefusal> {
    if der.is_empty() {
        return Err(CertificateRefusal::Encoding);
    }
    if view["agent"].as_str() != Some(holder) {
        return Err(CertificateRefusal::HolderMismatch);
    }
    if view["claims_are_live"] != false {
        return Err(CertificateRefusal::StatusUnavailable);
    }
    let expected = standard_base64(der);
    let mut matching = view["certificates"]
        .as_array()
        .ok_or(CertificateRefusal::StatusUnavailable)?
        .iter()
        .filter(|entry| entry["der"].as_str() == Some(expected.as_str()));
    let certificate = matching
        .next()
        .ok_or(CertificateRefusal::StatusUnavailable)?;
    if matching.next().is_some() {
        return Err(CertificateRefusal::StatusUnavailable);
    }
    match certificate.get("withdrawn") {
        Some(Value::Null) => Ok(()),
        Some(Value::Object(_)) => Err(CertificateRefusal::Withdrawn),
        _ => Err(CertificateRefusal::StatusUnavailable),
    }
}

pub(super) fn response(bytes: &[u8], holder: &str, der: &[u8]) -> Result<(), CertificateRefusal> {
    let rpc: Value =
        serde_json::from_slice(bytes).map_err(|_| CertificateRefusal::StatusUnavailable)?;
    if rpc["jsonrpc"] != "2.0"
        || rpc["id"] != 1
        || rpc.get("error").is_some()
        || rpc["result"]["isError"] != false
        || rpc["result"]["structuredContent"]["status"] != 200
    {
        return Err(CertificateRefusal::StatusUnavailable);
    }
    verify_view(&rpc["result"]["structuredContent"]["body"], holder, der)
}

fn standard_base64(bytes: &[u8]) -> String {
    const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    let mut output = String::new();
    for chunk in bytes.chunks(3) {
        let first = chunk[0];
        let second = chunk.get(1).copied().unwrap_or(0);
        let third = chunk.get(2).copied().unwrap_or(0);
        output.push(char::from(ALPHABET[usize::from(first >> 2)]));
        output.push(char::from(
            ALPHABET[usize::from((first & 3) << 4 | second >> 4)],
        ));
        output.push(if chunk.len() > 1 {
            char::from(ALPHABET[usize::from((second & 15) << 2 | third >> 6)])
        } else {
            '='
        });
        output.push(if chunk.len() > 2 {
            char::from(ALPHABET[usize::from(third & 63)])
        } else {
            '='
        });
    }
    output
}