ockam_identity 0.134.0

Ockam is a library for building devices that communicate securely, privately and trustfully with cloud services and other devices.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123

use crate::utils::now;
use crate::{AttributesEntry, Identifier, IdentityAttributesRepository};
use ockam_core::compat::sync::Arc;
use ockam_core::Result;
use tracing_attributes::instrument;

/// This struct provides access to the identities attributes stored on a node.
///
/// It is responsible for:
///
/// - Setting the time at which a given attribute is persisted
/// - Deleting expired attributes from storage. This deletion is performed every time the
///   repository is accessed to retrieve attributes
///
#[derive(Clone)]
pub struct IdentitiesAttributes {
    repository: Arc<dyn IdentityAttributesRepository>,
}

impl IdentitiesAttributes {
    /// Return a new IdentitiesAttributes struct
    pub fn new(repository: Arc<dyn IdentityAttributesRepository>) -> IdentitiesAttributes {
        IdentitiesAttributes { repository }
    }

    /// Return the attributes for a given pair subject/attesting authority
    /// If there are expired attributes for any subject, they are deleted before retrieving the attributes for the
    /// current subject.
    #[instrument(skip_all, fields(subject = %subject, attested_by = %attested_by))]
    pub async fn get_attributes(
        &self,
        subject: &Identifier,
        attested_by: &Identifier,
    ) -> Result<Option<AttributesEntry>> {
        self.repository.delete_expired_attributes(now()?).await?;
        self.repository.get_attributes(subject, attested_by).await
    }

    /// Set the attributes associated with the given identity identifier.
    /// Previous values gets overridden.
    #[instrument(skip_all, fields(subject = %subject, entry = %entry))]
    pub async fn put_attributes(&self, subject: &Identifier, entry: AttributesEntry) -> Result<()> {
        self.repository.put_attributes(subject, entry).await
    }
}

#[cfg(test)]
mod tests {
    use ockam_core::compat::collections::BTreeMap;
    use ockam_core::compat::sync::Arc;
    use std::time::Duration;

    use super::*;
    use crate::utils::now;
    use crate::{identities, IdentityAttributesSqlxDatabase, TimestampInSeconds};

    #[tokio::test]
    async fn test_identities_attributes_expiration() -> Result<()> {
        let identities_attributes = create_identities_attributes().await?;

        // store and retrieve attributes by identity
        let identifier1 = create_identity().await?;
        let identifier2 = create_identity().await?;
        let attributes1 = create_attributes_entry(&identifier1, now()?, 2.into()).await?;
        let attributes2 = create_attributes_entry(&identifier2, now()?, 6.into()).await?;

        identities_attributes
            .put_attributes(&identifier1, attributes1.clone())
            .await?;
        identities_attributes
            .put_attributes(&identifier2, attributes2.clone())
            .await?;

        tokio::time::sleep(Duration::from_secs(4)).await;

        let result = identities_attributes
            .get_attributes(&identifier1, &identifier1)
            .await?;
        assert_eq!(result, None);

        let result = identities_attributes
            .get_attributes(&identifier2, &identifier2)
            .await?;
        assert_eq!(result, Some(attributes2.clone()));

        tokio::time::sleep(Duration::from_secs(4)).await;

        let result = identities_attributes
            .get_attributes(&identifier2, &identifier2)
            .await?;
        assert_eq!(result, None);

        Ok(())
    }

    // HELPERS
    async fn create_attributes_entry(
        identifier: &Identifier,
        now: TimestampInSeconds,
        ttl: TimestampInSeconds,
    ) -> Result<AttributesEntry> {
        Ok(AttributesEntry::new(
            BTreeMap::from([
                ("name".as_bytes().to_vec(), "alice".as_bytes().to_vec()),
                ("age".as_bytes().to_vec(), "20".as_bytes().to_vec()),
            ]),
            now,
            Some(now + ttl),
            Some(identifier.clone()),
        ))
    }

    async fn create_identity() -> Result<Identifier> {
        let identities = identities().await?;
        identities.identities_creation().create_identity().await
    }

    async fn create_identities_attributes() -> Result<IdentitiesAttributes> {
        Ok(IdentitiesAttributes::new(Arc::new(
            IdentityAttributesSqlxDatabase::create().await?,
        )))
    }
}