Struct SignedRoomMessage 

pub struct SignedRoomMessage {
    pub fingerprint: String,
    pub ed25519_pubkey_b64: String,
    pub payload_b64: String,
    pub signature_b64: String,
    pub signed_at_ms: i64,
}

Application-level signed envelope around a RoomMessage. Used for any message whose authenticity matters beyond gossipsub’s transport- level signing.

The following variants MUST be sent inside a Signed envelope, and receivers MUST drop them when they arrive unsigned:

• MemberLeave (signer must equal the claimed sender_fingerprint; huddle 0.7.11 — closes the unsigned-leave spoof bug)
• MemberAnnounce (signer must equal the claimed sender_fingerprint; huddle 0.7.11 — closes the TOFU-pubkey hijack bug)
• FileOffer (signer must equal the claimed sender_fingerprint; huddle 0.7.11 — prevents attribution spoofing)
• RotateRoomKey (signer must equal the claimed rotator_fingerprint)
• OwnerGrant, BanMember (signer must be a current room owner)
• SasInit, SasResponse, SasConfirm (SAS handshake — signature binds the ephemeral X25519 pubkey to the sender’s identity)
• CodeJoinRequest, CodeJoinResponse (signer is the joiner / owner)
• JoinRefused (signer is a room owner; tells the rejected joiner it really came from the room)
• ProfileUpdate (signer must equal the claimed sender_fingerprint; prevents anyone from spoofing another peer’s username)

Verification happens via crate::crypto::verify_signed: it re-derives the fingerprint from ed25519_pubkey_b64, asserts equality with fingerprint, runs Ed25519::verify_strict over the decoded payload_b64, and rejects envelopes whose signed_at_ms falls outside a ±5 min window from now (replay protection).

Format choice: payload is base64’d serialized RoomMessage JSON (not the JSON bytes directly) so the envelope itself is plain JSON without escaping nightmares.

Fields

fingerprint: String

ed25519_pubkey_b64: String

payload_b64: String

signature_b64: String

signed_at_ms: i64

huddle 0.7.11: epoch-ms timestamp the sender bound into the signature, used by receivers as replay protection. #[serde(default)] for forward-compat parsing — but the verifier rejects 0 and values outside the configured window, so legacy pre-0.7.11 senders no longer satisfy verify_signed.

Trait Implementations

impl Clone for SignedRoomMessage

fn clone(&self) -> SignedRoomMessage

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SignedRoomMessage

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SignedRoomMessage

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for SignedRoomMessage

fn eq(&self, other: &SignedRoomMessage) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SignedRoomMessage

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for SignedRoomMessage

impl StructuralPartialEq for SignedRoomMessage