1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
//! Opaque native-host proof for control-plane bootstrap operations.
use crate::terminal_automation::NativeHostRuntimeToken;
use lingxia_platform::Platform;
use std::sync::Weak;
/// Proof that a control-plane operation originates from the native host that
/// bootstrapped the currently active runtime.
///
/// The type has no public constructor, clone implementation, serializer, or
/// process-global getter. Runtime internals receive it explicitly from the
/// host bootstrap path.
///
/// ```compile_fail
/// use lxapp::NativeControlPlaneAuthority;
/// let _ = NativeControlPlaneAuthority {};
/// ```
pub struct NativeControlPlaneAuthority {
runtime: Weak<Platform>,
#[cfg(any(test, feature = "test-utils"))]
test_authority: bool,
}
impl NativeControlPlaneAuthority {
pub(crate) fn for_native_runtime(proof: &NativeHostRuntimeToken) -> Self {
Self {
runtime: proof.runtime().clone(),
#[cfg(any(test, feature = "test-utils"))]
test_authority: false,
}
}
pub(crate) fn validate(&self) -> bool {
#[cfg(any(test, feature = "test-utils"))]
if self.test_authority {
return true;
}
let Some(runtime) = self.runtime.upgrade() else {
return false;
};
crate::get_platform().is_some_and(|current| std::sync::Arc::ptr_eq(¤t, &runtime))
}
/// Whether this opaque proof still belongs to the live platform runtime.
/// This reveals no credential and cannot mint or promote authority.
#[doc(hidden)]
pub fn is_live(&self) -> bool {
self.validate()
}
#[cfg(test)]
pub(crate) fn for_test() -> Self {
Self::for_test_harness()
}
#[cfg(any(test, feature = "test-utils"))]
pub(crate) fn for_test_harness() -> Self {
Self {
runtime: Weak::new(),
test_authority: true,
}
}
}