pubky 0.16.0

Pubky SDK
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

use pubky_common::capabilities::{Capabilities, Capability};

/// Relay payload format understood by a grant client.
///
/// Signed approvals (V1) deliver keys only for explicit `e` permissions,
/// independently of storage read/write permissions. Bare grants cannot ask
/// for keys.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
pub enum GrantApprovalFormat {
    /// A signed grant JWS without an approval envelope or encryption-key bundle.
    #[default]
    BareGrant,
    /// A V1 signed approval containing a grant and an encryption-key bundle.
    /// The bundle contains keys only for approved `e` scopes and may be empty.
    ///
    /// Encoded as `af=v1` in the deep link. Requires an `epk` value, which
    /// also identifies the HPKE-encrypted relay channel.
    SignedApprovalV1,
}

impl GrantApprovalFormat {
    pub(crate) fn validate_capabilities(self, capabilities: &Capabilities) -> crate::Result<()> {
        if self == Self::BareGrant && capabilities.iter().any(Capability::grants_encryption_keys) {
            return Err(crate::errors::AuthError::Validation(
                "encryption key permission requires af=v1".into(),
            )
            .into());
        }
        Ok(())
    }
}