qnsp 0.2.0

Official Rust SDK for the QNSP Quantum-Native Security Platform — post-quantum cryptography (ML-KEM, ML-DSA, SLH-DSA, Falcon via liboqs), PQC-encrypted vault, KMS, and immutable audit trails.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134

use base64::engine::general_purpose::STANDARD as B64;
use base64::Engine;
use chrono::{Duration, Utc};
use serde_json::json;
use wiremock::matchers::{method, path};
use wiremock::{Mock, MockServer, ResponseTemplate};

use qnsp::{audit, kms, vault, Client, ClientOptions};

async fn mock_activation(srv: &MockServer) {
    Mock::given(method("POST"))
        .and(path("/billing/v1/sdk/activate"))
        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
            "tenantId": "tenant-test",
            "tier": "free",
            "limits": {"sseEnabled": true},
            "activationToken": "tkn",
            "expiresAt": (Utc::now() + Duration::hours(1)).to_rfc3339(),
        })))
        .mount(srv)
        .await;
}

fn client_for(srv: &MockServer) -> Client {
    Client::new(ClientOptions {
        api_key: "qnsp_pqc_test".into(),
        base_url: srv.uri(),
        timeout_seconds: 5,
    })
    .unwrap()
}

#[tokio::test]
async fn vault_create_and_get() {
    let srv = MockServer::start().await;
    mock_activation(&srv).await;
    Mock::given(method("POST"))
        .and(path("/vault/v1/secrets"))
        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"id": "sec-1"})))
        .mount(&srv)
        .await;
    Mock::given(method("GET"))
        .and(path("/vault/v1/secrets/sec-1"))
        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"id": "sec-1", "version": 1})))
        .mount(&srv)
        .await;

    let c = client_for(&srv);
    let resp = c
        .vault()
        .create_secret(
            vault::CreateSecretRequest {
                name: "openai-api-key".into(),
                payload_b64: B64.encode(b"sk-..."),
                algorithm: Some("ml-kem-768".into()),
                metadata: None,
            },
            None,
        )
        .await
        .unwrap();
    assert_eq!(resp["id"], "sec-1");
    let get = c.vault().get_secret("sec-1").await.unwrap();
    assert_eq!(get["id"], "sec-1");
}

#[tokio::test]
async fn kms_create_sign_verify() {
    let srv = MockServer::start().await;
    mock_activation(&srv).await;
    Mock::given(method("POST"))
        .and(path("/kms/v1/keys"))
        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"keyId": "key-1"})))
        .mount(&srv)
        .await;
    Mock::given(method("POST"))
        .and(path("/kms/v1/keys/key-1/sign"))
        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"signatureB64": B64.encode(b"signature")})))
        .mount(&srv)
        .await;
    Mock::given(method("POST"))
        .and(path("/kms/v1/keys/key-1/verify"))
        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"valid": true})))
        .mount(&srv)
        .await;

    let c = client_for(&srv);
    let key = c
        .kms()
        .create_key(
            kms::CreateKeyRequest {
                algorithm: "ml-dsa-65".into(),
                purpose: "signing".into(),
                metadata: None,
            },
            None,
        )
        .await
        .unwrap();
    assert_eq!(key["keyId"], "key-1");
    let sig = c.kms().sign("key-1", b"hello", None).await.unwrap();
    assert_eq!(sig, b"signature");
    let ok = c.kms().verify("key-1", b"hello", &sig).await.unwrap();
    assert!(ok);
}

#[tokio::test]
async fn audit_log_event() {
    let srv = MockServer::start().await;
    mock_activation(&srv).await;
    Mock::given(method("POST"))
        .and(path("/audit/v1/events"))
        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"id": "evt-1"})))
        .mount(&srv)
        .await;

    let c = client_for(&srv);
    let resp = c
        .audit()
        .log_event(
            audit::LogEventRequest {
                event_type: "model.inference".into(),
                payload: serde_json::Map::from_iter([(
                    "modelId".to_string(),
                    serde_json::Value::String("gpt-4o".into()),
                )]),
                tags: None,
            },
            None,
        )
        .await
        .unwrap();
    assert_eq!(resp["id"], "evt-1");
}