vta_external/lib.rs
1//! External accounts: the VTA as the key authority for cloud and third-party
2//! accounts.
3//!
4//! An integration keeps needing to authenticate to someone else — a VTC to an
5//! S3 bucket, a VTC to Sui, an agent to a SaaS API — and the default answer
6//! everywhere is a long-lived secret pasted into the integration's config. This
7//! crate is the other answer: the VTA holds the account, and a bound
8//! integration gets back only something short-lived and downscoped.
9//!
10//! The wire surface is the `external/*` Trust Task family (trust-tasks-tf
11//! #740); the design is `docs/05-design-notes/vta-external-accounts.md`. This
12//! crate holds what does not depend on the service spine:
13//!
14//! - [`model`] — the stored account and its bindings, and the projection onto
15//! the wire `ExternalAccount`.
16//! - [`store`] — persistence in the `external_accounts` keyspace, plus the
17//! wrapped secrets in `external_secrets` (excluded from backup).
18//! - [`scope`] — validation of requested scopes and the binding ceiling check,
19//! in the order the issue specification requires.
20//! - [`driver`] — the [`ExternalAuthDriver`](driver::ExternalAuthDriver) trait
21//! and the registry of models this build serves.
22//! - [`s3_presign`] — the `s3-static-presign` model: SigV4 query presigning.
23//! - [`rate`] — the per-binding issuance rate.
24//! - [`fingerprint`] — keyed fingerprints of stored secrets.
25//!
26//! Five rules, from the design note's threat model, hold throughout:
27//!
28//! 1. No long-lived bearer secret leaves the VTA. Consumers get credentials
29//! that expire in minutes, only inside a sealed-transfer bundle.
30//! 2. Keys are pinned at the provider, never fetched from a host — so the VTA
31//! needs no inbound surface.
32//! 3. The VTA builds what it signs.
33//! 4. Least privilege at three layers: the provider's trust policy, the
34//! binding's ceiling, and each issuance's own scope.
35//! 5. Changing an account needs other administrators (the approvals defaults).
36
37pub mod batch;
38pub mod driver;
39pub mod fingerprint;
40pub mod model;
41pub mod rate;
42pub mod s3_presign;
43pub mod scope;
44pub mod store;