//! Generated by `trust-tasks-codegen` — do not edit by hand.
//!
//! Spec slug: `external/credentials/issue`. Version: `0.1`.
#[allow(unused_imports)]
use serde::{Deserialize, Serialize};
/// Error types.
pub mod error {
/// Error from a `TryFrom` or `FromStr` implementation.
pub struct ConversionError(::std::borrow::Cow<'static, str>);
impl ::std::error::Error for ConversionError {}
impl ::std::fmt::Display for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Display::fmt(&self.0, f)
}
}
impl ::std::fmt::Debug for ConversionError {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> Result<(), ::std::fmt::Error> {
::std::fmt::Debug::fmt(&self.0, f)
}
}
impl From<&'static str> for ConversionError {
fn from(value: &'static str) -> Self {
Self(value.into())
}
}
impl From<String> for ConversionError {
fn from(value: String) -> Self {
Self(value.into())
}
}
}
///The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountContextId",
/// "description": "The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.",
/// "type": "string",
/// "maxLength": 256,
/// "minLength": 1
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountContextId(::std::string::String);
impl ::std::ops::Deref for AccountContextId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountContextId> for ::std::string::String {
fn from(value: AccountContextId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountContextId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountContextId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountContextId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "AccountId",
/// "description": "The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.",
/// "type": "string",
/// "maxLength": 64,
/// "minLength": 1,
/// "pattern": "^[a-z0-9][a-z0-9-]*$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct AccountId(::std::string::String);
impl ::std::ops::Deref for AccountId {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<AccountId> for ::std::string::String {
fn from(value: AccountId) -> Self {
value.0
}
}
impl ::std::str::FromStr for AccountId {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 64usize {
return Err("longer than 64 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[a-z0-9][a-z0-9-]*$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z0-9][a-z0-9-]*$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for AccountId {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for AccountId {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for AccountId {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///What one issuance may do. For storage models, `prefix` and `actions` (both required, a rule this schema leaves to the custodian because other models use neither); for `s3-static-presign`, also `objectKey`, since a presigned URL is one operation on one object; for `oauth2-private-key-jwt`, `scopes`.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "CredentialScope",
/// "description": "What one issuance may do. For storage models, `prefix` and `actions` (both required, a rule this schema leaves to the custodian because other models use neither); for `s3-static-presign`, also `objectKey`, since a presigned URL is one operation on one object; for `oauth2-private-key-jwt`, `scopes`.",
/// "type": "object",
/// "properties": {
/// "actions": {
/// "type": "array",
/// "items": {
/// "$ref": "#/definitions/ProviderObjectAction"
/// },
/// "maxItems": 3,
/// "minItems": 1,
/// "uniqueItems": true
/// },
/// "objectKey": {
/// "description": "`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.",
/// "type": "string",
/// "maxLength": 1024,
/// "minLength": 1,
/// "pattern": "^[A-Za-z0-9._-]+$"
/// },
/// "prefix": {
/// "$ref": "#/definitions/ProviderObjectPrefix"
/// },
/// "scopes": {
/// "description": "`oauth2-private-key-jwt` only: the OAuth scopes requested.",
/// "type": "array",
/// "items": {
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
/// },
/// "maxItems": 64,
/// "uniqueItems": true
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct CredentialScope {
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub actions: ::std::option::Option<Vec<ProviderObjectAction>>,
///`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.
#[serde(
rename = "objectKey",
default,
skip_serializing_if = "::std::option::Option::is_none"
)]
pub object_key: ::std::option::Option<CredentialScopeObjectKey>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub prefix: ::std::option::Option<ProviderObjectPrefix>,
///`oauth2-private-key-jwt` only: the OAuth scopes requested.
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub scopes: ::std::option::Option<Vec<CredentialScopeScopesItem>>,
}
impl ::std::default::Default for CredentialScope {
fn default() -> Self {
Self {
actions: Default::default(),
object_key: Default::default(),
prefix: Default::default(),
scopes: Default::default(),
}
}
}
impl CredentialScope {
pub fn builder() -> builder::CredentialScope {
Default::default()
}
}
///`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "description": "`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.",
/// "type": "string",
/// "maxLength": 1024,
/// "minLength": 1,
/// "pattern": "^[A-Za-z0-9._-]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct CredentialScopeObjectKey(::std::string::String);
impl ::std::ops::Deref for CredentialScopeObjectKey {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<CredentialScopeObjectKey> for ::std::string::String {
fn from(value: CredentialScopeObjectKey) -> Self {
value.0
}
}
impl ::std::str::FromStr for CredentialScopeObjectKey {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 1024usize {
return Err("longer than 1024 characters".into());
}
if value.chars().count() < 1usize {
return Err("shorter than 1 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[A-Za-z0-9._-]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[A-Za-z0-9._-]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for CredentialScopeObjectKey {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for CredentialScopeObjectKey {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for CredentialScopeObjectKey {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for CredentialScopeObjectKey {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`CredentialScopeScopesItem`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "maxLength": 256,
/// "pattern": "^[!#-\\[\\]-~]+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct CredentialScopeScopesItem(::std::string::String);
impl ::std::ops::Deref for CredentialScopeScopesItem {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<CredentialScopeScopesItem> for ::std::string::String {
fn from(value: CredentialScopeScopesItem) -> Self {
value.0
}
}
impl ::std::str::FromStr for CredentialScopeScopesItem {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 256usize {
return Err("longer than 256 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| ::regress::Regex::new("^[!#-\\[\\]-~]+$").unwrap());
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[!#-\\[\\]-~]+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for CredentialScopeScopesItem {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for CredentialScopeScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for CredentialScopeScopesItem {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for CredentialScopeScopesItem {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Ext",
/// "description": "Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.",
/// "type": "object",
/// "minProperties": 1,
/// "additionalProperties": true,
/// "propertyNames": {
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
/// }
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(transparent)]
pub struct Ext(pub ::std::collections::HashMap<ExtKey, ::serde_json::Value>);
impl ::std::ops::Deref for Ext {
type Target = ::std::collections::HashMap<ExtKey, ::serde_json::Value>;
fn deref(&self) -> &::std::collections::HashMap<ExtKey, ::serde_json::Value> {
&self.0
}
}
impl ::std::convert::From<Ext> for ::std::collections::HashMap<ExtKey, ::serde_json::Value> {
fn from(value: Ext) -> Self {
value.0
}
}
impl ::std::convert::From<::std::collections::HashMap<ExtKey, ::serde_json::Value>> for Ext {
fn from(value: ::std::collections::HashMap<ExtKey, ::serde_json::Value>) -> Self {
Self(value)
}
}
///`ExtKey`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "type": "string",
/// "pattern": "^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ExtKey(::std::string::String);
impl ::std::ops::Deref for ExtKey {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ExtKey> for ::std::string::String {
fn from(value: ExtKey) -> Self {
value.0
}
}
impl ::std::str::FromStr for ExtKey {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^[a-z][a-z0-9-]*(\\.[a-z0-9-]+)+$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ExtKey {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ExtKey {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///Obtain a short-lived, downscoped provider credential from an external account, sealed to the caller. The outer document members are owned by the framework — SPEC §6.3.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "$id": "https://trusttasks.org/spec/external/credentials/issue/0.1",
/// "title": "Payload",
/// "description": "Obtain a short-lived, downscoped provider credential from an external account, sealed to the caller. The outer document members are owned by the framework — SPEC §6.3.",
/// "type": "object",
/// "required": [
/// "account",
/// "context",
/// "scope",
/// "ttlSeconds"
/// ],
/// "properties": {
/// "account": {
/// "$ref": "#/definitions/AccountId"
/// },
/// "context": {
/// "$ref": "#/definitions/AccountContextId"
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "scope": {
/// "$ref": "#/definitions/CredentialScope"
/// },
/// "ttlSeconds": {
/// "description": "Requested lifetime; never more than the binding's `maxTtlSeconds`.",
/// "type": "integer",
/// "maximum": 3600.0,
/// "minimum": 60.0
/// }
/// },
/// "additionalProperties": false
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Payload {
pub account: AccountId,
pub context: AccountContextId,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
pub scope: CredentialScope,
///Requested lifetime; never more than the binding's `maxTtlSeconds`.
#[serde(rename = "ttlSeconds")]
pub ttl_seconds: i64,
}
impl Payload {
pub fn builder() -> builder::Payload {
Default::default()
}
}
///`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderObjectAction",
/// "description": "`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.",
/// "type": "string",
/// "enum": [
/// "put",
/// "get",
/// "delete"
/// ]
///}
/// ```
/// </details>
#[derive(
::serde::Deserialize,
::serde::Serialize,
Clone,
Copy,
Debug,
Eq,
Hash,
Ord,
PartialEq,
PartialOrd,
)]
#[non_exhaustive]
pub enum ProviderObjectAction {
#[serde(rename = "put")]
Put,
#[serde(rename = "get")]
Get,
#[serde(rename = "delete")]
Delete,
}
impl ::std::fmt::Display for ProviderObjectAction {
fn fmt(&self, f: &mut ::std::fmt::Formatter<'_>) -> ::std::fmt::Result {
match *self {
Self::Put => f.write_str("put"),
Self::Get => f.write_str("get"),
Self::Delete => f.write_str("delete"),
}
}
}
impl ::std::str::FromStr for ProviderObjectAction {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
match value {
"put" => Ok(Self::Put),
"get" => Ok(Self::Get),
"delete" => Ok(Self::Delete),
_ => Err("invalid value".into()),
}
}
}
impl ::std::convert::TryFrom<&str> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectAction {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
///An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "ProviderObjectPrefix",
/// "description": "An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.",
/// "type": "string",
/// "maxLength": 512,
/// "minLength": 2,
/// "pattern": "^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct ProviderObjectPrefix(::std::string::String);
impl ::std::ops::Deref for ProviderObjectPrefix {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<ProviderObjectPrefix> for ::std::string::String {
fn from(value: ProviderObjectPrefix) -> Self {
value.0
}
}
impl ::std::str::FromStr for ProviderObjectPrefix {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 512usize {
return Err("longer than 512 characters".into());
}
if value.chars().count() < 2usize {
return Err("shorter than 2 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> =
::std::sync::LazyLock::new(|| {
::regress::Regex::new("^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$").unwrap()
});
if PATTERN.find(value).is_none() {
return Err("doesn't match pattern \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\"".into());
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for ProviderObjectPrefix {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for ProviderObjectPrefix {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
///`Response`
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "Response",
/// "type": "object",
/// "required": [
/// "expiresAt",
/// "scope",
/// "sealedCredential"
/// ],
/// "properties": {
/// "expiresAt": {
/// "description": "The provider's expiry for the credential, in the clear.",
/// "type": "string",
/// "format": "date-time"
/// },
/// "ext": {
/// "$ref": "#/definitions/Ext"
/// },
/// "scope": {
/// "description": "The scope actually granted, which equals the requested one.",
/// "$ref": "#/definitions/CredentialScope"
/// },
/// "sealedCredential": {
/// "$ref": "#/definitions/SealedTransferBundle"
/// }
/// },
/// "additionalProperties": false,
/// "$anchor": "response"
///}
/// ```
/// </details>
#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
#[serde(deny_unknown_fields)]
#[non_exhaustive]
pub struct Response {
///The provider's expiry for the credential, in the clear.
#[serde(rename = "expiresAt")]
pub expires_at: ::chrono::DateTime<::chrono::offset::Utc>,
#[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
pub ext: ::std::option::Option<Ext>,
///The scope actually granted, which equals the requested one.
pub scope: CredentialScope,
#[serde(rename = "sealedCredential")]
pub sealed_credential: SealedTransferBundle,
}
impl Response {
pub fn builder() -> builder::Response {
Default::default()
}
}
///A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of "the response" from ever holding a usable secret, whatever transport carried the document.
///
/// <details><summary>JSON schema</summary>
///
/// ```json
///{
/// "title": "SealedTransferBundle",
/// "description": "A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \"the response\" from ever holding a usable secret, whatever transport carried the document.",
/// "type": "string",
/// "maxLength": 65536,
/// "minLength": 64,
/// "pattern": "^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$"
///}
/// ```
/// </details>
#[derive(::serde::Serialize, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[serde(transparent)]
pub struct SealedTransferBundle(::std::string::String);
impl ::std::ops::Deref for SealedTransferBundle {
type Target = ::std::string::String;
fn deref(&self) -> &::std::string::String {
&self.0
}
}
impl ::std::convert::From<SealedTransferBundle> for ::std::string::String {
fn from(value: SealedTransferBundle) -> Self {
value.0
}
}
impl ::std::str::FromStr for SealedTransferBundle {
type Err = self::error::ConversionError;
fn from_str(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
if value.chars().count() > 65536usize {
return Err("longer than 65536 characters".into());
}
if value.chars().count() < 64usize {
return Err("shorter than 64 characters".into());
}
static PATTERN: ::std::sync::LazyLock<::regress::Regex> = ::std::sync::LazyLock::new(
|| {
::regress::Regex::new(
"^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$",
)
.unwrap()
},
);
if PATTERN.find(value).is_none() {
return Err(
"doesn't match pattern \"^-----BEGIN VTA SEALED BUNDLE-----[\\s\\S]+-----END VTA SEALED BUNDLE-----\\s*$\""
.into(),
);
}
Ok(Self(value.to_string()))
}
}
impl ::std::convert::TryFrom<&str> for SealedTransferBundle {
type Error = self::error::ConversionError;
fn try_from(value: &str) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<&::std::string::String> for SealedTransferBundle {
type Error = self::error::ConversionError;
fn try_from(
value: &::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl ::std::convert::TryFrom<::std::string::String> for SealedTransferBundle {
type Error = self::error::ConversionError;
fn try_from(
value: ::std::string::String,
) -> ::std::result::Result<Self, self::error::ConversionError> {
value.parse()
}
}
impl<'de> ::serde::Deserialize<'de> for SealedTransferBundle {
fn deserialize<D>(deserializer: D) -> ::std::result::Result<Self, D::Error>
where
D: ::serde::Deserializer<'de>,
{
::std::string::String::deserialize(deserializer)?
.parse()
.map_err(|e: self::error::ConversionError| {
<D::Error as ::serde::de::Error>::custom(e.to_string())
})
}
}
/// Types for composing complex structures.
pub mod builder {
#[derive(Clone, Debug)]
pub struct CredentialScope {
actions: ::std::result::Result<
::std::option::Option<Vec<super::ProviderObjectAction>>,
::std::string::String,
>,
object_key: ::std::result::Result<
::std::option::Option<super::CredentialScopeObjectKey>,
::std::string::String,
>,
prefix: ::std::result::Result<
::std::option::Option<super::ProviderObjectPrefix>,
::std::string::String,
>,
scopes: ::std::result::Result<
::std::option::Option<Vec<super::CredentialScopeScopesItem>>,
::std::string::String,
>,
}
impl ::std::default::Default for CredentialScope {
fn default() -> Self {
Self {
actions: Ok(Default::default()),
object_key: Ok(Default::default()),
prefix: Ok(Default::default()),
scopes: Ok(Default::default()),
}
}
}
impl CredentialScope {
pub fn actions<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<Vec<super::ProviderObjectAction>>>,
T::Error: ::std::fmt::Display,
{
self.actions = value
.try_into()
.map_err(|e| format!("error converting supplied value for actions: {e}"));
self
}
pub fn object_key<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::CredentialScopeObjectKey>>,
T::Error: ::std::fmt::Display,
{
self.object_key = value
.try_into()
.map_err(|e| format!("error converting supplied value for object_key: {e}"));
self
}
pub fn prefix<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::ProviderObjectPrefix>>,
T::Error: ::std::fmt::Display,
{
self.prefix = value
.try_into()
.map_err(|e| format!("error converting supplied value for prefix: {e}"));
self
}
pub fn scopes<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<
::std::option::Option<Vec<super::CredentialScopeScopesItem>>,
>,
T::Error: ::std::fmt::Display,
{
self.scopes = value
.try_into()
.map_err(|e| format!("error converting supplied value for scopes: {e}"));
self
}
}
impl ::std::convert::TryFrom<CredentialScope> for super::CredentialScope {
type Error = super::error::ConversionError;
fn try_from(
value: CredentialScope,
) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
actions: value.actions?,
object_key: value.object_key?,
prefix: value.prefix?,
scopes: value.scopes?,
})
}
}
impl ::std::convert::From<super::CredentialScope> for CredentialScope {
fn from(value: super::CredentialScope) -> Self {
Self {
actions: Ok(value.actions),
object_key: Ok(value.object_key),
prefix: Ok(value.prefix),
scopes: Ok(value.scopes),
}
}
}
#[derive(Clone, Debug)]
pub struct Payload {
account: ::std::result::Result<super::AccountId, ::std::string::String>,
context: ::std::result::Result<super::AccountContextId, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
scope: ::std::result::Result<super::CredentialScope, ::std::string::String>,
ttl_seconds: ::std::result::Result<i64, ::std::string::String>,
}
impl ::std::default::Default for Payload {
fn default() -> Self {
Self {
account: Err("no value supplied for account".to_string()),
context: Err("no value supplied for context".to_string()),
ext: Ok(Default::default()),
scope: Err("no value supplied for scope".to_string()),
ttl_seconds: Err("no value supplied for ttl_seconds".to_string()),
}
}
}
impl Payload {
pub fn account<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountId>,
T::Error: ::std::fmt::Display,
{
self.account = value
.try_into()
.map_err(|e| format!("error converting supplied value for account: {e}"));
self
}
pub fn context<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::AccountContextId>,
T::Error: ::std::fmt::Display,
{
self.context = value
.try_into()
.map_err(|e| format!("error converting supplied value for context: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn scope<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::CredentialScope>,
T::Error: ::std::fmt::Display,
{
self.scope = value
.try_into()
.map_err(|e| format!("error converting supplied value for scope: {e}"));
self
}
pub fn ttl_seconds<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<i64>,
T::Error: ::std::fmt::Display,
{
self.ttl_seconds = value
.try_into()
.map_err(|e| format!("error converting supplied value for ttl_seconds: {e}"));
self
}
}
impl ::std::convert::TryFrom<Payload> for super::Payload {
type Error = super::error::ConversionError;
fn try_from(value: Payload) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
account: value.account?,
context: value.context?,
ext: value.ext?,
scope: value.scope?,
ttl_seconds: value.ttl_seconds?,
})
}
}
impl ::std::convert::From<super::Payload> for Payload {
fn from(value: super::Payload) -> Self {
Self {
account: Ok(value.account),
context: Ok(value.context),
ext: Ok(value.ext),
scope: Ok(value.scope),
ttl_seconds: Ok(value.ttl_seconds),
}
}
}
#[derive(Clone, Debug)]
pub struct Response {
expires_at:
::std::result::Result<::chrono::DateTime<::chrono::offset::Utc>, ::std::string::String>,
ext: ::std::result::Result<::std::option::Option<super::Ext>, ::std::string::String>,
scope: ::std::result::Result<super::CredentialScope, ::std::string::String>,
sealed_credential:
::std::result::Result<super::SealedTransferBundle, ::std::string::String>,
}
impl ::std::default::Default for Response {
fn default() -> Self {
Self {
expires_at: Err("no value supplied for expires_at".to_string()),
ext: Ok(Default::default()),
scope: Err("no value supplied for scope".to_string()),
sealed_credential: Err("no value supplied for sealed_credential".to_string()),
}
}
}
impl Response {
pub fn expires_at<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::chrono::DateTime<::chrono::offset::Utc>>,
T::Error: ::std::fmt::Display,
{
self.expires_at = value
.try_into()
.map_err(|e| format!("error converting supplied value for expires_at: {e}"));
self
}
pub fn ext<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<::std::option::Option<super::Ext>>,
T::Error: ::std::fmt::Display,
{
self.ext = value
.try_into()
.map_err(|e| format!("error converting supplied value for ext: {e}"));
self
}
pub fn scope<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::CredentialScope>,
T::Error: ::std::fmt::Display,
{
self.scope = value
.try_into()
.map_err(|e| format!("error converting supplied value for scope: {e}"));
self
}
pub fn sealed_credential<T>(mut self, value: T) -> Self
where
T: ::std::convert::TryInto<super::SealedTransferBundle>,
T::Error: ::std::fmt::Display,
{
self.sealed_credential = value
.try_into()
.map_err(|e| format!("error converting supplied value for sealed_credential: {e}"));
self
}
}
impl ::std::convert::TryFrom<Response> for super::Response {
type Error = super::error::ConversionError;
fn try_from(value: Response) -> ::std::result::Result<Self, super::error::ConversionError> {
Ok(Self {
expires_at: value.expires_at?,
ext: value.ext?,
scope: value.scope?,
sealed_credential: value.sealed_credential?,
})
}
}
impl ::std::convert::From<super::Response> for Response {
fn from(value: super::Response) -> Self {
Self {
expires_at: Ok(value.expires_at),
ext: Ok(value.ext),
scope: Ok(value.scope),
sealed_credential: Ok(value.sealed_credential),
}
}
}
}
impl crate::Payload for Payload {
const TYPE_URI: &'static str = "https://trusttasks.org/spec/external/credentials/issue/0.1";
const IS_PROOF_REQUIRED: bool = true;
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"AccountContextId\": {\n \"description\": \"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\n \"maxLength\": 256,\n \"minLength\": 1,\n \"title\": \"AccountContextId\",\n \"type\": \"string\"\n },\n \"AccountId\": {\n \"description\": \"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"title\": \"AccountId\",\n \"type\": \"string\"\n },\n \"CredentialScope\": {\n \"additionalProperties\": false,\n \"description\": \"What one issuance may do. For storage models, `prefix` and `actions` (both required, a rule this schema leaves to the custodian because other models use neither); for `s3-static-presign`, also `objectKey`, since a presigned URL is one operation on one object; for `oauth2-private-key-jwt`, `scopes`.\",\n \"properties\": {\n \"actions\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectAction\"\n },\n \"maxItems\": 3,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"objectKey\": {\n \"description\": \"`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.\",\n \"maxLength\": 1024,\n \"minLength\": 1,\n \"pattern\": \"^[A-Za-z0-9._-]+$\",\n \"type\": \"string\"\n },\n \"prefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\"\n },\n \"scopes\": {\n \"description\": \"`oauth2-private-key-jwt` only: the OAuth scopes requested.\",\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n }\n },\n \"title\": \"CredentialScope\",\n \"type\": \"object\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"ProviderObjectAction\": {\n \"description\": \"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\n \"enum\": [\n \"put\",\n \"get\",\n \"delete\"\n ],\n \"title\": \"ProviderObjectAction\",\n \"type\": \"string\"\n },\n \"ProviderObjectPrefix\": {\n \"description\": \"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\n \"maxLength\": 512,\n \"minLength\": 2,\n \"pattern\": \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\n \"title\": \"ProviderObjectPrefix\",\n \"type\": \"string\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"properties\": {\n \"expiresAt\": {\n \"description\": \"The provider's expiry for the credential, in the clear.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"scope\": {\n \"$ref\": \"#/$defs/CredentialScope\",\n \"description\": \"The scope actually granted, which equals the requested one.\"\n },\n \"sealedCredential\": {\n \"$ref\": \"#/$defs/SealedTransferBundle\"\n }\n },\n \"required\": [\n \"sealedCredential\",\n \"expiresAt\",\n \"scope\"\n ],\n \"title\": \"External Credentials — Issue — response payload\",\n \"type\": \"object\"\n },\n \"SealedTransferBundle\": {\n \"description\": \"A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \\\"the response\\\" from ever holding a usable secret, whatever transport carried the document.\",\n \"maxLength\": 65536,\n \"minLength\": 64,\n \"pattern\": \"^-----BEGIN VTA SEALED BUNDLE-----[\\\\s\\\\S]+-----END VTA SEALED BUNDLE-----\\\\s*$\",\n \"title\": \"SealedTransferBundle\",\n \"type\": \"string\"\n }\n },\n \"$id\": \"https://trusttasks.org/spec/external/credentials/issue/0.1\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n \"additionalProperties\": false,\n \"description\": \"Obtain a short-lived, downscoped provider credential from an external account, sealed to the caller. The outer document members are owned by the framework — SPEC §6.3.\",\n \"properties\": {\n \"account\": {\n \"$ref\": \"#/$defs/AccountId\"\n },\n \"context\": {\n \"$ref\": \"#/$defs/AccountContextId\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"scope\": {\n \"$ref\": \"#/$defs/CredentialScope\"\n },\n \"ttlSeconds\": {\n \"description\": \"Requested lifetime; never more than the binding's `maxTtlSeconds`.\",\n \"maximum\": 3600,\n \"minimum\": 60,\n \"type\": \"integer\"\n }\n },\n \"required\": [\n \"context\",\n \"account\",\n \"scope\",\n \"ttlSeconds\"\n ],\n \"title\": \"External Credentials — Issue — payload\",\n \"type\": \"object\"\n}\n",
);
}
impl crate::Payload for Response {
const TYPE_URI: &'static str =
"https://trusttasks.org/spec/external/credentials/issue/0.1#response";
const IS_PROOF_REQUIRED: bool = true;
const IS_ISSUED_AT_REQUIRED: bool = true;
const IS_RECIPIENT_REQUIRED: bool = true;
const PAYLOAD_SCHEMA: Option<&'static str> = Some(
"{\n \"$defs\": {\n \"AccountContextId\": {\n \"description\": \"The custodian context that owns the account. Act scope in this context decides who may manage the account and who may consume it; the account's keys are derived in this context's key space.\",\n \"maxLength\": 256,\n \"minLength\": 1,\n \"title\": \"AccountContextId\",\n \"type\": \"string\"\n },\n \"AccountId\": {\n \"description\": \"The account's identifier within its context, chosen by whoever creates it. Lowercase letters, digits and hyphens, so that it can be embedded in a certificate subject, a token subject or a provider-side condition without escaping. Unique per context; never reused after deletion while anything that names it (a provider-side trust policy, an audit row) may still exist.\",\n \"maxLength\": 64,\n \"minLength\": 1,\n \"pattern\": \"^[a-z0-9][a-z0-9-]*$\",\n \"title\": \"AccountId\",\n \"type\": \"string\"\n },\n \"CredentialScope\": {\n \"additionalProperties\": false,\n \"description\": \"What one issuance may do. For storage models, `prefix` and `actions` (both required, a rule this schema leaves to the custodian because other models use neither); for `s3-static-presign`, also `objectKey`, since a presigned URL is one operation on one object; for `oauth2-private-key-jwt`, `scopes`.\",\n \"properties\": {\n \"actions\": {\n \"items\": {\n \"$ref\": \"#/$defs/ProviderObjectAction\"\n },\n \"maxItems\": 3,\n \"minItems\": 1,\n \"type\": \"array\",\n \"uniqueItems\": true\n },\n \"objectKey\": {\n \"description\": \"`s3-static-presign` only: the object's name within `prefix`. The presigned URL names `prefix` + `objectKey` and nothing else, and `actions` must hold exactly one action.\",\n \"maxLength\": 1024,\n \"minLength\": 1,\n \"pattern\": \"^[A-Za-z0-9._-]+$\",\n \"type\": \"string\"\n },\n \"prefix\": {\n \"$ref\": \"#/$defs/ProviderObjectPrefix\"\n },\n \"scopes\": {\n \"description\": \"`oauth2-private-key-jwt` only: the OAuth scopes requested.\",\n \"items\": {\n \"maxLength\": 256,\n \"pattern\": \"^[!#-\\\\[\\\\]-~]+$\",\n \"type\": \"string\"\n },\n \"maxItems\": 64,\n \"type\": \"array\",\n \"uniqueItems\": true\n }\n },\n \"title\": \"CredentialScope\",\n \"type\": \"object\"\n },\n \"Ext\": {\n \"additionalProperties\": true,\n \"description\": \"Vendor-namespaced extension object per SPEC.md §4.5.1. Each immediate key MUST be a reverse-DNS namespace; structure under each namespace is opaque to the framework.\",\n \"minProperties\": 1,\n \"propertyNames\": {\n \"pattern\": \"^[a-z][a-z0-9-]*(\\\\.[a-z0-9-]+)+$\"\n },\n \"title\": \"Ext\",\n \"type\": \"object\"\n },\n \"ProviderObjectAction\": {\n \"description\": \"`put`: write an object. `get`: read one. `delete`: remove one. No list, ACL, policy or bucket-level action exists here, so none can be granted.\",\n \"enum\": [\n \"put\",\n \"get\",\n \"delete\"\n ],\n \"title\": \"ProviderObjectAction\",\n \"type\": \"string\"\n },\n \"ProviderObjectPrefix\": {\n \"description\": \"An object-key prefix within the account's bucket: one or more segments of lowercase letters, digits, `.`, `_` and `-`, each beginning with a letter or digit and ending with `/`. No quote, backslash, wildcard, whitespace, `..` segment or empty segment can appear. That is deliberate: the custodian places this value inside a provider policy — an IAM session policy (JSON), a GCS Credential Access Boundary condition (CEL) — and a value able to carry a metacharacter can break out of the string it is placed in and widen the policy. That is a known class of defect (CVE-2026-42811, a CEL injection in downscoped GCS credentials). Even with this pattern, a custodian MUST build provider policies with the provider language's own encoder, never by string interpolation.\",\n \"maxLength\": 512,\n \"minLength\": 2,\n \"pattern\": \"^([a-z0-9][a-z0-9._-]{0,127}/){1,16}$\",\n \"title\": \"ProviderObjectPrefix\",\n \"type\": \"string\"\n },\n \"Response\": {\n \"$anchor\": \"response\",\n \"additionalProperties\": false,\n \"properties\": {\n \"expiresAt\": {\n \"description\": \"The provider's expiry for the credential, in the clear.\",\n \"format\": \"date-time\",\n \"type\": \"string\"\n },\n \"ext\": {\n \"$ref\": \"#/$defs/Ext\"\n },\n \"scope\": {\n \"$ref\": \"#/$defs/CredentialScope\",\n \"description\": \"The scope actually granted, which equals the requested one.\"\n },\n \"sealedCredential\": {\n \"$ref\": \"#/$defs/SealedTransferBundle\"\n }\n },\n \"required\": [\n \"sealedCredential\",\n \"expiresAt\",\n \"scope\"\n ],\n \"title\": \"External Credentials — Issue — response payload\",\n \"type\": \"object\"\n },\n \"SealedTransferBundle\": {\n \"description\": \"A sealed-transfer bundle: OpenPGP-style ASCII armor around an HPKE-sealed `SealedPayloadV1` (base mode, X25519-HKDF-SHA256 KEM, HKDF-SHA256 KDF, ChaCha20-Poly1305 AEAD, info string `vta-sealed-transfer/v1`), with a producer assertion and Bundle-Id, Chunk and Digest-Algo headers bound into the associated data. Each task states the key it is sealed to: a single-use wrapping key from keys/import-wrapping-key for external/accounts/secret/set, and the caller's key-agreement key for external/credentials/issue. Its cleartext is an ExternalSecretPayload or an ExternalCredentialPayload. The only form in which secret material crosses the wire in this family, in either direction: the seal is what keeps a terminating proxy, a relay, a request log or a debug dump of \\\"the response\\\" from ever holding a usable secret, whatever transport carried the document.\",\n \"maxLength\": 65536,\n \"minLength\": 64,\n \"pattern\": \"^-----BEGIN VTA SEALED BUNDLE-----[\\\\s\\\\S]+-----END VTA SEALED BUNDLE-----\\\\s*$\",\n \"title\": \"SealedTransferBundle\",\n \"type\": \"string\"\n }\n },\n \"$ref\": \"#/$defs/Response\",\n \"$schema\": \"https://json-schema.org/draft/2020-12/schema\"\n}\n",
);
}
impl crate::RequestPayload for Payload {
type Response = Response;
}
/// The extended error codes this specification declares (SPEC §7.3 item 9,
/// §8.5), in declaration order. Empty when it declares none.
pub const ERROR_CODES: &[crate::DeclaredErrorCode] = &[
error_codes::NOT_FOUND,
error_codes::NOT_ACTIVE,
error_codes::NOT_BOUND,
error_codes::SCOPE_OUTSIDE_CEILING,
error_codes::TTL_TOO_LONG,
error_codes::RATE_LIMITED,
error_codes::PROVIDER_SETUP_REQUIRED,
error_codes::PROVIDER_REFUSED,
error_codes::PROVIDER_UNAVAILABLE,
error_codes::NOT_BROKERED,
error_codes::NO_KEY_AGREEMENT,
];
/// One constant per extended error code this specification declares
/// (SPEC §7.3 item 9), named for its local part.
///
/// Emit these rather than a string literal: the code is read from the
/// specification, so it cannot name a code the specification never
/// declared.
pub mod error_codes {
/// `external:notFound`
///
/// No account with this id exists in the named context that the caller may see. See the family conventions §2.
///
/// Declared `retryable: false`.
pub const NOT_FOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:notFound",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `external:notActive`
///
/// The account is `suspended` or `archived` and cannot be used.
///
/// Declared `retryable: false`.
pub const NOT_ACTIVE: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:notActive",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `external:notBound`
///
/// The caller is not the consumer of any binding on this account.
///
/// Declared `retryable: false`.
pub const NOT_BOUND: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:notBound",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `external/credentials/issue:scopeOutsideCeiling`
///
/// The requested scope is not inside the binding's ceiling, or is not a scope the account's model can express (no prefix for a storage model, more than one action for a presigned URL).
///
/// Declared `retryable: false`.
pub const SCOPE_OUTSIDE_CEILING: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external/credentials/issue:scopeOutsideCeiling",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `external/credentials/issue:ttlTooLong`
///
/// `ttlSeconds` exceeds the binding's `maxTtlSeconds`. `details.maxTtlSeconds` states it.
///
/// Declared `retryable: false`.
/// Declares a `detailsSchema` for the error's `details` member.
pub const TTL_TOO_LONG: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external/credentials/issue:ttlTooLong",
retryable: false,
details_schema: ::core::option::Option::Some(
"{\"additionalProperties\":false,\"properties\":{\"maxTtlSeconds\":{\"minimum\":60,\"type\":\"integer\"}},\"required\":[\"maxTtlSeconds\"],\"type\":\"object\"}",
),
};
/// `external:rateLimited`
///
/// The binding's rate is exhausted. `details.retryAfterSeconds` says when to try again.
///
/// Declared `retryable: true`.
/// Declares a `detailsSchema` for the error's `details` member.
pub const RATE_LIMITED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:rateLimited",
retryable: true,
details_schema: ::core::option::Option::Some(
"{\"additionalProperties\":false,\"properties\":{\"retryAfterSeconds\":{\"minimum\":1,\"type\":\"integer\"}},\"required\":[\"retryAfterSeconds\"],\"type\":\"object\"}",
),
};
/// `external:providerSetupRequired`
///
/// The account cannot be used until its provider-side setup is redone: after a restore that could not carry its key or secret, or while a rotation awaits confirmation.
///
/// Declared `retryable: false`.
pub const PROVIDER_SETUP_REQUIRED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:providerSetupRequired",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `external:providerRefused`
///
/// The provider refused the custodian's request. `details.providerError` carries the provider's words, verbatim, truncated, with any credential removed.
///
/// Declared `retryable: false`.
/// Declares a `detailsSchema` for the error's `details` member.
pub const PROVIDER_REFUSED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:providerRefused",
retryable: false,
details_schema: ::core::option::Option::Some(
"{\"additionalProperties\":false,\"properties\":{\"providerError\":{\"maxLength\":2048,\"type\":\"string\"},\"providerRequestId\":{\"maxLength\":256,\"type\":\"string\"}},\"required\":[\"providerError\"],\"type\":\"object\"}",
),
};
/// `external:providerUnavailable`
///
/// The provider could not be reached or did not answer in time.
///
/// Declared `retryable: true`.
pub const PROVIDER_UNAVAILABLE: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external:providerUnavailable",
retryable: true,
details_schema: ::core::option::Option::None,
};
/// `external/credentials/issue:notBrokered`
///
/// The account is `sui-signer`, which issues no credentials; use external/sign.
///
/// Declared `retryable: false`.
pub const NOT_BROKERED: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external/credentials/issue:notBrokered",
retryable: false,
details_schema: ::core::option::Option::None,
};
/// `external/credentials/issue:noKeyAgreement`
///
/// The caller's DID offers no X25519 key-agreement key to seal the credential to: it is not a `did:key`, and its resolved DID document has no X25519 `keyAgreement` verification method.
///
/// Declared `retryable: false`.
pub const NO_KEY_AGREEMENT: crate::DeclaredErrorCode = crate::DeclaredErrorCode {
code: "external/credentials/issue:noKeyAgreement",
retryable: false,
details_schema: ::core::option::Option::None,
};
}