//! Generated by `trust-tasks-codegen` — do not edit by hand.
//!
//! Spec slug: `external/accounts/setup`. Version: `0.1`.
#[allow(unused_imports)]
use serde::{Deserialize, Serialize};
/// Error types.
pub mod error {
/// Error from a `TryFrom` or `FromStr` implementation.
pub struct ConversionError(::std::borrow::Cow<'static, str>);
impl ::std::error::Error for ConversionError {}
impl ::std::fmt::Display for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Display::fmt(&self.0, f)
}
}
impl ::std::fmt::Debug for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Debug::fmt(&self.0, f)
}
}
impl From<&'static str> for ConversionError {
fn from(value: &'static str) -> Self {
Self(value.into())
}
}
impl From<String> for ConversionError {
fn from(value: String) -> Self {
Self(value.into())
}
}
}
///The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountContextId",
/// "description": "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.",
/// "type": "string",
/// "maxLength": 256,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountContextId(::std::string::String);
impl ::std::ops::Deref for AccountContextId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountContextId> for ::std::string::String {
fn from(value: AccountContextId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountContextId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountContextId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountId",
/// "description": "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.",
/// "type": "string",
/// "maxLength": 64,
/// "minLength": 1,
/// "pattern": "^[a-z0-9][a-z0-9-]*$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountId(::std::string::String);
impl ::std::ops::Deref for AccountId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountId> for ::std::string::String {
fn from(value: AccountId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9][a-z0-9-]*$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9-]*$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountSetupArtifacts",
/// "description": "What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.",
/// "type": "object",
/// "required": [
/// "artifacts",
/// "model",
/// "steps"
/// ],
/// "properties": {
/// "artifacts": {
/// "type": "array",
/// "items": {
/// "type": "object",
/// "required": [
/// "content",
/// "mediaType",
/// "name"
/// ],
/// "properties": {
/// "content": {
/// "type": "string",
/// "maxLength": 65536
/// },
/// "mediaType": {
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[a-z]+/[a-z0-9.+-]+$"
/// },
/// "name": {
/// "description": "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.",
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[A-Za-z0-9._-]+$"
/// }
/// },
/// "additionalProperties": false
/// },
/// "maxItems": 16
/// },
/// "model": {
/// "$ref": "#/definitions/AuthModel"
/// },
/// "steps": {
/// "type": "array",
/// "items": {
/// "type": "object",
/// "required": [
/// "description"
/// ],
/// "properties": {
/// "command": {
/// "description": "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.",
/// "type": "string",
/// "maxLength": 8192
/// },
/// "description": {
/// "type": "string",
/// "maxLength": 1024
/// }
/// },
/// "additionalProperties": false
/// },
/// "maxItems": 32
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountSetupArtifacts {
pub artifacts: ::std::vec::Vec<AccountSetupArtifactsArtifactsItem>,
pub model: AuthModel,
pub steps: ::std::vec::Vec<AccountSetupArtifactsStepsItem>,
}
impl AccountSetupArtifacts {
pub fn builder() -> builder::AccountSetupArtifacts {
Default::default()
}
}
///`AccountSetupArtifactsArtifactsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "object",
/// "required": [
/// "content",
/// "mediaType",
/// "name"
/// ],
/// "properties": {
/// "content": {
/// "type": "string",
/// "maxLength": 65536
/// },
/// "mediaType": {
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[a-z]+/[a-z0-9.+-]+$"
/// },
/// "name": {
/// "description": "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.",
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[A-Za-z0-9._-]+$"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountSetupArtifactsArtifactsItem {
pub content: AccountSetupArtifactsArtifactsItemContent,
#[serde(rename = "mediaType")]
pub media_type: AccountSetupArtifactsArtifactsItemMediaType,
///File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
pub name: AccountSetupArtifactsArtifactsItemName,
}
impl AccountSetupArtifactsArtifactsItem {
pub fn builder() -> builder::AccountSetupArtifactsArtifactsItem {
Default::default()
}
}
///`AccountSetupArtifactsArtifactsItemContent`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 65536
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSetupArtifactsArtifactsItemContent(::std::string::String);
impl ::std::ops::Deref for AccountSetupArtifactsArtifactsItemContent {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSetupArtifactsArtifactsItemContent> for ::std::string::String {
fn from(value: AccountSetupArtifactsArtifactsItemContent) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSetupArtifactsArtifactsItemContent {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 65536usize {
return Err("longer than 65536 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSetupArtifactsArtifactsItemContent {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSetupArtifactsArtifactsItemContent {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSetupArtifactsArtifactsItemContent {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSetupArtifactsArtifactsItemContent {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSetupArtifactsArtifactsItemMediaType`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[a-z]+/[a-z0-9.+-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSetupArtifactsArtifactsItemMediaType(::std::string::String);
impl ::std::ops::Deref for AccountSetupArtifactsArtifactsItemMediaType {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSetupArtifactsArtifactsItemMediaType> for ::std::string::String {
fn from(value: AccountSetupArtifactsArtifactsItemMediaType) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSetupArtifactsArtifactsItemMediaType {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z]+/[a-z0-9.+-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z]+/[a-z0-9.+-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSetupArtifactsArtifactsItemMediaType {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String>
for AccountSetupArtifactsArtifactsItemMediaType
{
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String>
for AccountSetupArtifactsArtifactsItemMediaType
{
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSetupArtifactsArtifactsItemMediaType {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.",
/// "type": "string",
/// "maxLength": 128,
/// "pattern": "^[A-Za-z0-9._-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSetupArtifactsArtifactsItemName(::std::string::String);
impl ::std::ops::Deref for AccountSetupArtifactsArtifactsItemName {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSetupArtifactsArtifactsItemName> for ::std::string::String {
fn from(value: AccountSetupArtifactsArtifactsItemName) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSetupArtifactsArtifactsItemName {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 128usize {
return Err("longer than 128 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9._-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9._-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSetupArtifactsArtifactsItemName {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSetupArtifactsArtifactsItemName {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSetupArtifactsArtifactsItemName {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSetupArtifactsArtifactsItemName {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSetupArtifactsStepsItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "object",
/// "required": [
/// "description"
/// ],
/// "properties": {
/// "command": {
/// "description": "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.",
/// "type": "string",
/// "maxLength": 8192
/// },
/// "description": {
/// "type": "string",
/// "maxLength": 1024
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct AccountSetupArtifactsStepsItem {
///A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub command: ::std::option::Option<AccountSetupArtifactsStepsItemCommand>,
pub description: AccountSetupArtifactsStepsItemDescription,
}
impl AccountSetupArtifactsStepsItem {
pub fn builder() -> builder::AccountSetupArtifactsStepsItem {
Default::default()
}
}
///A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.",
/// "type": "string",
/// "maxLength": 8192
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSetupArtifactsStepsItemCommand(::std::string::String);
impl ::std::ops::Deref for AccountSetupArtifactsStepsItemCommand {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSetupArtifactsStepsItemCommand> for ::std::string::String {
fn from(value: AccountSetupArtifactsStepsItemCommand) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSetupArtifactsStepsItemCommand {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 8192usize {
return Err("longer than 8192 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSetupArtifactsStepsItemCommand {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSetupArtifactsStepsItemCommand {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSetupArtifactsStepsItemCommand {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSetupArtifactsStepsItemCommand {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`AccountSetupArtifactsStepsItemDescription`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 1024
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountSetupArtifactsStepsItemDescription(::std::string::String);
impl ::std::ops::Deref for AccountSetupArtifactsStepsItemDescription {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountSetupArtifactsStepsItemDescription> for ::std::string::String {
fn from(value: AccountSetupArtifactsStepsItemDescription) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountSetupArtifactsStepsItemDescription {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountSetupArtifactsStepsItemDescription {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountSetupArtifactsStepsItemDescription {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountSetupArtifactsStepsItemDescription {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountSetupArtifactsStepsItemDescription {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
/**
How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.
Plain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.*/
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AuthModel",
/// "description": "How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\n\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.",
/// "type": "string",
/// "enum": [
/// "aws-roles-anywhere",
/// "gcp-wif-pinned",
/// "azure-cert",
/// "oauth2-private-key-jwt",
/// "s3-static-presign",
/// "sui-signer",
/// "static-secret"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum AuthModel {
#[serde(rename = "aws-roles-anywhere")]
AwsRolesAnywhere,
#[serde(rename = "gcp-wif-pinned")]
GcpWifPinned,
#[serde(rename = "azure-cert")]
AzureCert,
#[serde(rename = "oauth2-private-key-jwt")]
Oauth2PrivateKeyJwt,
#[serde(rename = "s3-static-presign")]
S3StaticPresign,
#[serde(rename = "sui-signer")]
SuiSigner,
#[serde(rename = "static-secret")]
StaticSecret,
}
impl ::std::fmt::Display for AuthModel {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::AwsRolesAnywhere => f.write_str("aws-roles-anywhere"),
Self::GcpWifPinned => f.write_str("gcp-wif-pinned"),
Self::AzureCert => f.write_str("azure-cert"),
Self::Oauth2PrivateKeyJwt => f.write_str("oauth2-private-key-jwt"),
Self::S3StaticPresign => f.write_str("s3-static-presign"),
Self::SuiSigner => f.write_str("sui-signer"),
Self::StaticSecret => f.write_str("static-secret"),
}
}
}
impl ::std::str::FromStr for AuthModel {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"aws-roles-anywhere" => Ok(Self::AwsRolesAnywhere),
"gcp-wif-pinned" => Ok(Self::GcpWifPinned),
"azure-cert" => Ok(Self::AzureCert),
"oauth2-private-key-jwt" => Ok(Self::Oauth2PrivateKeyJwt),
"s3-static-presign" => Ok(Self::S3StaticPresign),
"sui-signer" => Ok(Self::SuiSigner),
"static-secret" => Ok(Self::StaticSecret),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for AuthModel {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AuthModel {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AuthModel {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Ext",
/// "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
/// "type": "object",
/// "minProperties": 1,
/// "additionalProperties": true,
/// "propertyNames": {
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
/// }
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Ext(pub ::std::collections::HashMap<ExtKey, ::serde_json::Value>);
impl ::std::ops::Deref for Ext {
type Target = ::std::collections::HashMap<ExtKey, ::serde_json::Value>;
fn deref(&self) -> &::std::collections::HashMap<ExtKey, ::serde_json::Value> {
&self.0
}
}
impl ::std::convert::From<Ext> for ::std::collections::HashMap<ExtKey, ::serde_json::Value> {
fn from(value: Ext) -> Self {
value.0
}
}
impl ::std::convert::From<::std::collections::HashMap<ExtKey, ::serde_json::Value>> for Ext {
fn from(value: ::std::collections::HashMap<ExtKey, ::serde_json::Value>) -> Self {
Self(value)
}
}
///`ExtKey`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExtKey(::std::string::String);
impl ::std::ops::Deref for ExtKey {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExtKey> for ::std::string::String {
fn from(value: ExtKey) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExtKey {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExtKey {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Generate the provider-side setup for an external account. The outer document members are owned by the framework — SPEC §6.3.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "$id": "https://trusttasks.org/spec/external/accounts/setup/0.1",
/// "title": "Payload",
/// "description": "Generate the provider-side setup for an external account. The outer document members are owned by the framework — SPEC §6.3.",
/// "type": "object",
/// "required": [
/// "context",
/// "id"
/// ],
/// "properties": {
/// "context": {
/// "$ref": "#/definitions/AccountContextId"
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "id": {
/// "$ref": "#/definitions/AccountId"
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Payload {
pub context: AccountContextId,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
pub id: AccountId,
}
impl Payload {
pub fn builder() -> builder::Payload {
Default::default()
}
}
///`Response`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Response",
/// "type": "object",
/// "required": [
/// "setup"
/// ],
/// "properties": {
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "setup": {
/// "$ref": "#/definitions/AccountSetupArtifacts"
/// }
/// },
/// "additionalProperties": false,
/// "$anchor": "response"
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Response {
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
pub setup: AccountSetupArtifacts,
}
impl Response {
pub fn builder() -> builder::Response {
Default::default()
}
}
/// Types for composing complex structures.
pub mod builder {
#[derive(Clone, Debug)]
pub struct AccountSetupArtifacts {
artifacts: ::std::result::Result<
::std::vec::Vec<super::AccountSetupArtifactsArtifactsItem>,
::std::string::String,
>,
model: ::std::result::Result<super::AuthModel, ::std::string::String>,
steps: ::std::result::Result<
::std::vec::Vec<super::AccountSetupArtifactsStepsItem>,
::std::string::String,
>,
}
impl ::std::default::Default for AccountSetupArtifacts {
fn default() -> Self {
Self {
artifacts: Err("no value supplied for artifacts".to_string()),
model: Err("no value supplied for model".to_string()),
steps: Err("no value supplied for steps".to_string()),
}
}
}
impl AccountSetupArtifacts {
pub fn artifacts<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountSetupArtifactsArtifactsItem>>,
T::Error: ::std::fmt::Display,
{
self.artifacts = value
.try_into()
.map_err(|e| format!("error converting supplied value for artifacts: {e}"));
self
}
pub fn model<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AuthModel>,
T::Error: ::std::fmt::Display,
{
self.model = value
.try_into()
.map_err(|e| format!("error converting supplied value for model: {e}"));
self
}
pub fn steps<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::vec::Vec<super::AccountSetupArtifactsStepsItem>>,
T::Error: ::std::fmt::Display,
{
self.steps = value
.try_into()
.map_err(|e| format!("error converting supplied value for steps: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountSetupArtifacts> for super::AccountSetupArtifacts {
type Error = super::error::ConversionError;
fn try_from(
value: AccountSetupArtifacts,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
artifacts: value.artifacts?,
model: value.model?,
steps: value.steps?,
})
}
}
impl ::std::convert::From<super::AccountSetupArtifacts> for AccountSetupArtifacts {
fn from(value: super::AccountSetupArtifacts) -> Self {
Self {
artifacts: Ok(value.artifacts),
model: Ok(value.model),
steps: Ok(value.steps),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountSetupArtifactsArtifactsItem {
content: ::std::result::Result<
super::AccountSetupArtifactsArtifactsItemContent,
::std::string::String,
>,
media_type: ::std::result::Result<
super::AccountSetupArtifactsArtifactsItemMediaType,
::std::string::String,
>,
name: ::std::result::Result<
super::AccountSetupArtifactsArtifactsItemName,
::std::string::String,
>,
}
impl ::std::default::Default for AccountSetupArtifactsArtifactsItem {
fn default() -> Self {
Self {
content: Err("no value supplied for content".to_string()),
media_type: Err("no value supplied for media_type".to_string()),
name: Err("no value supplied for name".to_string()),
}
}
}
impl AccountSetupArtifactsArtifactsItem {
pub fn content<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSetupArtifactsArtifactsItemContent>,
T::Error: ::std::fmt::Display,
{
self.content = value
.try_into()
.map_err(|e| format!("error converting supplied value for content: {e}"));
self
}
pub fn media_type<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSetupArtifactsArtifactsItemMediaType>,
T::Error: ::std::fmt::Display,
{
self.media_type = value
.try_into()
.map_err(|e| format!("error converting supplied value for media_type: {e}"));
self
}
pub fn name<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSetupArtifactsArtifactsItemName>,
T::Error: ::std::fmt::Display,
{
self.name = value
.try_into()
.map_err(|e| format!("error converting supplied value for name: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountSetupArtifactsArtifactsItem>
for super::AccountSetupArtifactsArtifactsItem
{
type Error = super::error::ConversionError;
fn try_from(
value: AccountSetupArtifactsArtifactsItem,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
content: value.content?,
media_type: value.media_type?,
name: value.name?,
})
}
}
impl ::std::convert::From<super::AccountSetupArtifactsArtifactsItem>
for AccountSetupArtifactsArtifactsItem
{
fn from(value: super::AccountSetupArtifactsArtifactsItem) -> Self {
Self {
content: Ok(value.content),
media_type: Ok(value.media_type),
name: Ok(value.name),
}
}
}
#[derive(Clone, Debug)]
pub struct AccountSetupArtifactsStepsItem {
command: ::std::result::Result<
::std::option::Option<super::AccountSetupArtifactsStepsItemCommand>,
::std::string::String,
>,
description: ::std::result::Result<
super::AccountSetupArtifactsStepsItemDescription,
::std::string::String,
>,
}
impl ::std::default::Default for AccountSetupArtifactsStepsItem {
fn default() -> Self {
Self {
command: Ok(Default::default()),
description: Err("no value supplied for description".to_string()),
}
}
}
impl AccountSetupArtifactsStepsItem {
pub fn command<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<super::AccountSetupArtifactsStepsItemCommand>,
>,
T::Error: ::std::fmt::Display,
{
self.command = value
.try_into()
.map_err(|e| format!("error converting supplied value for command: {e}"));
self
}
pub fn description<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSetupArtifactsStepsItemDescription>,
T::Error: ::std::fmt::Display,
{
self.description = value
.try_into()
.map_err(|e| format!("error converting supplied value for description: {e}"));
self
}
}
impl ::std::convert::TryFrom<AccountSetupArtifactsStepsItem>
for super::AccountSetupArtifactsStepsItem
{
type Error = super::error::ConversionError;
fn try_from(
value: AccountSetupArtifactsStepsItem,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
command: value.command?,
description: value.description?,
})
}
}
impl ::std::convert::From<super::AccountSetupArtifactsStepsItem>
for AccountSetupArtifactsStepsItem
{
fn from(value: super::AccountSetupArtifactsStepsItem) -> Self {
Self {
command: Ok(value.command),
description: Ok(value.description),
}
}
}
#[derive(Clone, Debug)]
pub struct Payload {
context: ::std::result::Result<super::AccountContextId, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
id: ::std::result::Result<super::AccountId, ::std::string::String>,
}
impl ::std::default::Default for Payload {
fn default() -> Self {
Self {
context: Err("no value supplied for context".to_string()),
ext: Ok(Default::default()),
id: Err("no value supplied for id".to_string()),
}
}
}
impl Payload {
pub fn context<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountContextId>,
T::Error: ::std::fmt::Display,
{
self.context = value
.try_into()
.map_err(|e| format!("error converting supplied value for context: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn id<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountId>,
T::Error: ::std::fmt::Display,
{
self.id = value
.try_into()
.map_err(|e| format!("error converting supplied value for id: {e}"));
self
}
}
impl ::std::convert::TryFrom<Payload> for super::Payload {
type Error = super::error::ConversionError;
fn try_from(value: Payload) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
context: value.context?,
ext: value.ext?,
id: value.id?,
})
}
}
impl ::std::convert::From<super::Payload> for Payload {
fn from(value: super::Payload) -> Self {
Self {
context: Ok(value.context),
ext: Ok(value.ext),
id: Ok(value.id),
}
}
}
#[derive(Clone, Debug)]
pub struct Response {
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
setup: ::std::result::Result<super::AccountSetupArtifacts, ::std::string::String>,
}
impl ::std::default::Default for Response {
fn default() -> Self {
Self {
ext: Ok(Default::default()),
setup: Err("no value supplied for setup".to_string()),
}
}
}
impl Response {
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn setup<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountSetupArtifacts>,
T::Error: ::std::fmt::Display,
{
self.setup = value
.try_into()
.map_err(|e| format!("error converting supplied value for setup: {e}"));
self
}
}
impl ::std::convert::TryFrom<Response> for super::Response {
type Error = super::error::ConversionError;
fn try_from(value: Response) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
ext: value.ext?,
setup: value.setup?,
})
}
}
impl ::std::convert::From<super::Response> for Response {
fn from(value: super::Response) -> Self {
Self {
ext: Ok(value.ext),
setup: Ok(value.setup),
}
}
}
}
impl crate::Payload for Payload {
const TYPE_URI: &'static str = "https://trusttasks.org/spec/external/accounts/setup/0.1";
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"AccountContextId\": {\n \"description\": \"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\n \"maxLength\": 256,\n \"minLength\": 1,\n \"title\": \"AccountContextId\",\n \"type\": \"string\"\n },\n \"AccountId\": {\n \"description\": \"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"title\": \"AccountId\",\n \"type\": \"string\"\n },\n \"AccountSetupArtifacts\": {\n \"additionalProperties\": false,\n \"description\": \"What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.\",\n \"properties\": {\n \"artifacts\": {\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"content\": {\n \"maxLength\": 65536,\n \"type\": \"string\"\n },\n \"mediaType\": {\n \"maxLength\": 128,\n \"pattern\": \"^[a-z]+/[a-z0-9.+-]+$\",\n \"type\": \"string\"\n },\n \"name\": {\n \"description\": \"File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.\",\n \"maxLength\": 128,\n \"pattern\": \"^[A-Za-z0-9._-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"name\",\n \"mediaType\",\n \"content\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 16,\n \"type\": \"array\"\n },\n \"model\": {\n \"$ref\": \"#/$defs/AuthModel\"\n },\n \"steps\": {\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"command\": {\n \"description\": \"A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.\",\n \"maxLength\": 8192,\n \"type\": \"string\"\n },\n \"description\": {\n \"maxLength\": 1024,\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"description\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 32,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"model\",\n \"artifacts\",\n \"steps\"\n ],\n \"title\": \"AccountSetupArtifacts\",\n \"type\": \"object\"\n },\n \"AuthModel\": {\n \"description\": \"How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\\n\\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.\",\n \"enum\": [\n \"aws-roles-anywhere\",\n \"gcp-wif-pinned\",\n \"azure-cert\",\n \"oauth2-private-key-jwt\",\n \"s3-static-presign\",\n \"sui-signer\",\n \"static-secret\"\n ],\n \"title\": \"AuthModel\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"properties\": {\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"setup\": {\n \"$ref\": \"#/$defs/AccountSetupArtifacts\"\n }\n },\n \"required\": [\n \"setup\"\n ],\n \"title\": \"External Accounts — Setup — response payload\",\n \"type\": \"object\"\n }\n },\n \"$id\": \"https://trusttasks.org/spec/external/accounts/setup/0.1\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"additionalProperties\": false,\n \"description\": \"Generate the provider-side setup for an external account. The outer document members are owned by the framework — SPEC §6.3.\",\n \"properties\": {\n \"context\": {\n \"$ref\": \"#/$defs/AccountContextId\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"id\": {\n \"$ref\": \"#/$defs/AccountId\"\n }\n },\n \"required\": [\n \"context\",\n \"id\"\n ],\n \"title\": \"External Accounts — Setup — payload\",\n \"type\": \"object\"\n}\n",
);
}
impl crate::Payload for Response {
const TYPE_URI: &'static str =
"https://trusttasks.org/spec/external/accounts/setup/0.1#response";
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"AccountContextId\": {\n \"description\": \"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\n \"maxLength\": 256,\n \"minLength\": 1,\n \"title\": \"AccountContextId\",\n \"type\": \"string\"\n },\n \"AccountId\": {\n \"description\": \"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"title\": \"AccountId\",\n \"type\": \"string\"\n },\n \"AccountSetupArtifacts\": {\n \"additionalProperties\": false,\n \"description\": \"What an administrator does at the provider to make an account usable, generated by the custodian from the account's settings, public material and bindings. Public material and policy only: never a private key or secret, and the custodian never asks for the provider's administrator credentials.\",\n \"properties\": {\n \"artifacts\": {\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"content\": {\n \"maxLength\": 65536,\n \"type\": \"string\"\n },\n \"mediaType\": {\n \"maxLength\": 128,\n \"pattern\": \"^[a-z]+/[a-z0-9.+-]+$\",\n \"type\": \"string\"\n },\n \"name\": {\n \"description\": \"File name to save it under: `trust-anchor.pem`, `jwks.json`, `permissions-policy.json`, `crl.pem`.\",\n \"maxLength\": 128,\n \"pattern\": \"^[A-Za-z0-9._-]+$\",\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"name\",\n \"mediaType\",\n \"content\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 16,\n \"type\": \"array\"\n },\n \"model\": {\n \"$ref\": \"#/$defs/AuthModel\"\n },\n \"steps\": {\n \"items\": {\n \"additionalProperties\": false,\n \"properties\": {\n \"command\": {\n \"description\": \"A provider CLI command (`aws rolesanywhere create-trust-anchor …`, `gcloud iam workload-identity-pools providers create-oidc … --jwk-json-path`, `az ad app credential reset --cert …`), referring to artifacts by `name`.\",\n \"maxLength\": 8192,\n \"type\": \"string\"\n },\n \"description\": {\n \"maxLength\": 1024,\n \"type\": \"string\"\n }\n },\n \"required\": [\n \"description\"\n ],\n \"type\": \"object\"\n },\n \"maxItems\": 32,\n \"type\": \"array\"\n }\n },\n \"required\": [\n \"model\",\n \"artifacts\",\n \"steps\"\n ],\n \"title\": \"AccountSetupArtifacts\",\n \"type\": \"object\"\n },\n \"AuthModel\": {\n \"description\": \"How the account authenticates to its provider. Every model pins the custodian's verification material in the provider's own account, uploaded once, so no model requires the custodian to be reachable from the internet. `aws-roles-anywhere`: the custodian is the certificate authority of an IAM Roles Anywhere trust anchor, and signs CreateSession with a short-lived end-entity certificate it issued to the account's own key. `gcp-wif-pinned`: a Workload Identity Federation pool provider holds an uploaded JWKS; the custodian signs an ID token and exchanges it at Google's STS. `azure-cert`: a certificate uploaded to an Entra app registration; the custodian signs an RFC 7523 client assertion. `oauth2-private-key-jwt`: the same RFC 7523 client authentication against any token endpoint that registered the custodian's public key. `s3-static-presign`: an access-key pair for an S3-compatible store that cannot federate; the custodian presigns per-object URLs and never releases the key. `sui-signer`: a Sui address derived from the custodian's key; the custodian signs only allow-listed transactions. `static-secret`: an API key or token used inside the custodian by a named driver; last resort, never released.\\n\\nPlain OpenID Connect discovery federation is deliberately absent. It works by the provider fetching the issuer's JWKS from a public URL, which either makes the custodian reachable from the internet or makes whoever hosts a copy of the JWKS able to mint credentials for every federated role.\",\n \"enum\": [\n \"aws-roles-anywhere\",\n \"gcp-wif-pinned\",\n \"azure-cert\",\n \"oauth2-private-key-jwt\",\n \"s3-static-presign\",\n \"sui-signer\",\n \"static-secret\"\n ],\n \"title\": \"AuthModel\",\n \"type\": \"string\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"properties\": {\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"setup\": {\n \"$ref\": \"#/$defs/AccountSetupArtifacts\"\n }\n },\n \"required\": [\n \"setup\"\n ],\n \"title\": \"External Accounts — Setup — response payload\",\n \"type\": \"object\"\n }\n },\n \"$ref\": \"#/$defs/Response\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\"\n}\n",
);
}
impl crate::RequestPayload for Payload {
type Response = Response;
}
/// The extended error codes this specification declares (SPEC §7.3 item 9,
/// §8.5), in declaration order. Empty when it declares none.
pub const ERROR_CODES: &[crate::DeclaredErrorCode] = &[error_codes::NOT_FOUND];
/// One constant per extended error code this specification declares
/// (SPEC §7.3 item 9), named for its local part.
///
/// Emit these rather than a string literal: the code is read from the
/// specification, so it cannot name a code the specification never
/// declared.
pub mod error_codes {
/// `external:notFound`
///
/// No account with this id exists in the named context that the caller may see. See the family conventions §2.
///
/// Declared `retryable: false`.
pub const NOT_FOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:notFound",
retryable: false,
details_schema: ::core::option::Option::None,
};
}