vta-service 0.2.0

Service for Verifiable Trust Agents operating in Verifiable Trust Communities
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

use std::sync::Arc;

use tokio::sync::RwLock;
use tracing::info;

use vta_sdk::credentials::CredentialBundle;
use vta_sdk::protocols::credential_management::generate::GenerateCredentialsResultBody;

use crate::acl::{AclEntry, Role, store_acl_entry, validate_acl_modification};
use crate::auth::credentials::generate_did_key;
use crate::auth::AuthClaims;
use crate::auth::session::now_epoch;
use crate::config::AppConfig;
use crate::error::AppError;
use crate::store::KeyspaceHandle;

pub async fn generate_credentials(
    acl_ks: &KeyspaceHandle,
    config: &Arc<RwLock<AppConfig>>,
    auth: &AuthClaims,
    role: Role,
    label: Option<String>,
    allowed_contexts: Vec<String>,
    channel: &str,
) -> Result<GenerateCredentialsResultBody, AppError> {
    auth.require_manage()?;
    validate_acl_modification(auth, &allowed_contexts)?;

    let cfg = config.read().await;
    let vta_did = cfg
        .vta_did
        .as_ref()
        .ok_or_else(|| AppError::Internal("VTA DID not configured".into()))?
        .clone();
    let vta_url = cfg.public_url.clone();
    drop(cfg);

    let (did, private_key_multibase) = generate_did_key();

    let entry = AclEntry {
        did: did.clone(),
        role: role.clone(),
        label,
        allowed_contexts,
        created_at: now_epoch(),
        created_by: auth.did.clone(),
    };
    store_acl_entry(acl_ks, &entry).await?;

    let bundle = CredentialBundle {
        did: did.clone(),
        private_key_multibase,
        vta_did,
        vta_url,
    };
    let credential = bundle
        .encode()
        .map_err(|e| AppError::Internal(e.to_string()))?;

    info!(channel, did = %did, role = %role, caller = %auth.did, "credentials generated");

    Ok(GenerateCredentialsResultBody {
        did,
        credential,
        role: role.to_string(),
    })
}