vta-service 0.36.0

Service for Verifiable Trust Agents operating in Verifiable Trust Communities
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116

//! `policy/*` slice trust-task handlers — runtime Policy Decision Point
//! management.
//!
//! Wire adapters only; the logic (and every authorization check) lives in
//! [`crate::operations::policy`], so the REST surface and the dispatcher cannot
//! diverge on who may do what.
//!
//! Auth: `list`/`get`/`evaluate` are admin, `upsert`/`delete` are super-admin —
//! enforced inside the operation functions, not here.

use serde_json::Value;
use trust_tasks_rs::TrustTask;

use vta_sdk::protocols::policy_management::{
    DeletePolicyBody, GetPolicyBody, ListPoliciesBody, UpsertPolicyBody,
};

use super::helpers::{
    TRANSPORT_TRUST_TASK, TrustTaskOutcome, app_error_to_reject, parse_payload, success_response,
};
use crate::auth::AuthClaims;
use crate::operations;
use crate::server::AppState;

/// Handler for canonical `policy/list/0.2`.
pub(super) async fn handle_list(
    state: &AppState,
    auth: &AuthClaims,
    doc: TrustTask<Value>,
) -> TrustTaskOutcome {
    let req: ListPoliciesBody = match parse_payload(&doc) {
        Ok(r) => r,
        Err(resp) => return resp,
    };
    match operations::policy::list_policies(
        &state.policy_ks,
        auth,
        req.context_id.as_deref(),
        req.enabled_only,
        req.page_size,
        TRANSPORT_TRUST_TASK,
    )
    .await
    {
        Ok(body) => success_response(&doc, body),
        Err(e) => app_error_to_reject(&doc, e),
    }
}

/// Handler for canonical `policy/get/0.1`.
pub(super) async fn handle_get(
    state: &AppState,
    auth: &AuthClaims,
    doc: TrustTask<Value>,
) -> TrustTaskOutcome {
    let req: GetPolicyBody = match parse_payload(&doc) {
        Ok(r) => r,
        Err(resp) => return resp,
    };
    match operations::policy::get_policy(&state.policy_ks, auth, &req.id, TRANSPORT_TRUST_TASK)
        .await
    {
        Ok(body) => success_response(&doc, body),
        Err(e) => app_error_to_reject(&doc, e),
    }
}

/// Handler for canonical `policy/upsert/0.2`. Super-admin.
pub(super) async fn handle_upsert(
    state: &AppState,
    auth: &AuthClaims,
    doc: TrustTask<Value>,
) -> TrustTaskOutcome {
    let req: UpsertPolicyBody = match parse_payload(&doc) {
        Ok(r) => r,
        Err(resp) => return resp,
    };
    match operations::policy::upsert_policy(
        &state.policy_ks,
        &state.audit_sink,
        auth,
        req,
        TRANSPORT_TRUST_TASK,
    )
    .await
    {
        Ok(body) => success_response(&doc, body),
        Err(e) => app_error_to_reject(&doc, e),
    }
}

/// Handler for canonical `policy/delete/0.1`. Super-admin.
pub(super) async fn handle_delete(
    state: &AppState,
    auth: &AuthClaims,
    doc: TrustTask<Value>,
) -> TrustTaskOutcome {
    let req: DeletePolicyBody = match parse_payload(&doc) {
        Ok(r) => r,
        Err(resp) => return resp,
    };
    match operations::policy::delete_policy(
        &state.policy_ks,
        &state.audit_sink,
        auth,
        &req.id,
        req.expected_version,
        req.reason.as_deref(),
        TRANSPORT_TRUST_TASK,
    )
    .await
    {
        Ok(body) => success_response(&doc, body),
        Err(e) => app_error_to_reject(&doc, e),
    }
}