dpcs/model/
security.rs

1//! Security metadata (SPEC Ch 24).
2
3use serde::{Deserialize, Serialize};
4
5use super::ExtensionMap;
6
7/// Declarative security metadata attached to a Pipeline Contract.
8///
9/// Authentication, authorization, and secret-management systems remain outside
10/// DPCS scope. This model records portable references and integrity pointers.
11#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
12#[cfg_attr(feature = "jsonschema", derive(schemars::JsonSchema))]
13#[serde(rename_all = "camelCase")]
14pub struct SecurityMetadata {
15    /// External secret references (URIs or vault paths). Must not embed secret values.
16    #[serde(default, skip_serializing_if = "Vec::is_empty")]
17    pub secret_refs: Vec<SecretReference>,
18    /// Integrity references (hashes, signatures, or attestation pointers).
19    #[serde(default, skip_serializing_if = "Vec::is_empty")]
20    pub integrity_refs: Vec<IntegrityReference>,
21    /// Optional security domain / isolation annotation.
22    #[serde(default, skip_serializing_if = "Option::is_none")]
23    pub security_domain: Option<String>,
24    /// Optional audit policy identifier or reference.
25    #[serde(default, skip_serializing_if = "Option::is_none")]
26    pub audit_policy_ref: Option<String>,
27    /// Extension fields.
28    #[serde(default, flatten)]
29    pub extensions: ExtensionMap,
30}
31
32/// Reference to an externally managed secret.
33#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
34#[cfg_attr(feature = "jsonschema", derive(schemars::JsonSchema))]
35#[serde(rename_all = "camelCase")]
36pub struct SecretReference {
37    /// Stable identifier for this secret reference.
38    pub id: String,
39    /// External locator (URI, vault path, or provider reference).
40    pub loc: String,
41    /// Optional provider hint (for example `vault` or `aws-secrets-manager`).
42    #[serde(default, skip_serializing_if = "Option::is_none")]
43    pub provider: Option<String>,
44    /// Extension fields.
45    #[serde(default, flatten)]
46    pub extensions: ExtensionMap,
47}
48
49/// Integrity reference for tamper detection / attestation.
50#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
51#[cfg_attr(feature = "jsonschema", derive(schemars::JsonSchema))]
52#[serde(rename_all = "camelCase")]
53pub struct IntegrityReference {
54    /// Algorithm or kind (for example `sha256` or `cosign`).
55    pub kind: String,
56    /// Digest, signature reference, or external locator (not an embedded key).
57    pub value: String,
58    /// Extension fields.
59    #[serde(default, flatten)]
60    pub extensions: ExtensionMap,
61}
dpcs/model/security.rs

dpcs/model/
security.rs
