ockam_identity 0.134.0

Ockam is a library for building devices that communicate securely, privately and trustfully with cloud services and other devices.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

use ockam_core::compat::boxed::Box;
use ockam_core::compat::collections::BTreeMap;
use ockam_core::compat::string::String;
use ockam_core::compat::sync::Arc;
use ockam_core::{async_trait, Address, AllowAll, DenyAll, Mailboxes, Result};
use ockam_node::compat::asynchronous::RwLock;
use ockam_node::Context;
use ockam_transport_core::Transport;
use tracing::debug;

use crate::{
    CredentialRetriever, CredentialRetrieverCreator, Identifier, RemoteCredentialRetriever,
    RemoteCredentialRetrieverInfo, RemoteCredentialRetrieverTimingOptions, SecureChannels,
};

/// Creator for [`RemoteCredentialRetriever`]
pub struct RemoteCredentialRetrieverCreator {
    ctx: Context,
    transport: Arc<dyn Transport>,
    secure_channels: Arc<SecureChannels>,
    info: RemoteCredentialRetrieverInfo,
    scope: String,
    timing_options: RemoteCredentialRetrieverTimingOptions,

    // Should be only one retriever per subject Identifier
    registry: RwLock<BTreeMap<Identifier, Arc<RemoteCredentialRetriever>>>,
}

impl RemoteCredentialRetrieverCreator {
    /// Constructor
    pub fn new(
        ctx: Context,
        transport: Arc<dyn Transport>,
        secure_channels: Arc<SecureChannels>,
        info: RemoteCredentialRetrieverInfo,
        scope: String,
    ) -> Self {
        Self {
            ctx,
            transport,
            secure_channels,
            info,
            scope,
            timing_options: Default::default(),
            registry: Default::default(),
        }
    }

    /// Constructor
    pub fn new_extended(
        ctx: Context,
        transport: Arc<dyn Transport>,
        secure_channels: Arc<SecureChannels>,
        info: RemoteCredentialRetrieverInfo,
        scope: String,
        timing_options: RemoteCredentialRetrieverTimingOptions,
    ) -> Self {
        Self {
            ctx,
            transport,
            secure_channels,
            info,
            scope,
            timing_options,
            registry: Default::default(),
        }
    }
}

#[async_trait]
impl CredentialRetrieverCreator for RemoteCredentialRetrieverCreator {
    async fn create(&self, subject: &Identifier) -> Result<Arc<dyn CredentialRetriever>> {
        debug!(
            "Requested RemoteCredentialRetriever for: {}, authority: {}",
            subject, self.info.issuer
        );

        let registry = self.registry.read().await;
        if let Some(existing_retriever) = registry.get(subject) {
            debug!(
                "Returning existing RemoteCredentialRetriever for: {}, authority: {}",
                subject, self.info.issuer
            );
            return Ok(existing_retriever.clone());
        }

        drop(registry);

        let mut registry = self.registry.write().await;
        if let Some(existing_retriever) = registry.get(subject) {
            debug!(
                "Returning existing RemoteCredentialRetriever for: {}, authority: {}",
                subject, self.info.issuer
            );
            return Ok(existing_retriever.clone());
        }

        debug!(
            "Creating new RemoteCredentialRetriever for: {}, authority: {}",
            subject, self.info.issuer
        );
        let mailboxes = Mailboxes::primary(
            Address::random_tagged("RemoteCredentialRetriever"),
            Arc::new(DenyAll),
            Arc::new(AllowAll),
        );
        let ctx = self.ctx.new_detached_with_mailboxes(mailboxes)?;
        let retriever = RemoteCredentialRetriever::new(
            ctx,
            self.transport.clone(),
            self.secure_channels.clone(),
            self.info.clone(),
            subject.clone(),
            self.scope.clone(),
            self.timing_options,
        );
        debug!(
            "Created RemoteCredentialRetriever for: {}, authority: {}",
            subject, self.info.issuer
        );
        let retriever = Arc::new(retriever);

        registry.insert(subject.clone(), retriever.clone());

        Ok(retriever)
    }
}