ic_auth_wire/
lib.rs

1//! Controlled portable-session transport. No endpoint installation, authority,
2//! cryptography, session storage or delivery/retry policy is supplied here.
3pub mod model;
4pub use ic_wire as wire;
5use ic_wire::{Limits, List, Method, Text, Wire};
6use model::{LogoutResult, PortableCredential};
7
8/// Admission narrowing accompanies the exact opaque signed credential.
9#[derive(Clone, Debug, Eq, PartialEq, Wire)]
10pub struct SessionInput {
11    #[wire(id = 1)]
12    pub credential: PortableCredential,
13    #[wire(id = 2)]
14    pub scopes: List<Text<64>, 16>,
15    #[wire(id = 3)]
16    pub ttl_secs: Option<u64>,
17}
18/// A receiver's authenticated local reply, never a transferable authorization.
19#[derive(Clone, Debug, Eq, PartialEq, Wire)]
20pub struct SessionView {
21    #[wire(id = 1)]
22    pub caller: ic_wire::Bytes<29>,
23    #[wire(id = 2)]
24    pub issuer: ic_wire::Bytes<29>,
25    #[wire(id = 3)]
26    pub subject: ic_wire::Bytes<29>,
27    #[wire(id = 4)]
28    pub expires_at_ns: u64,
29}
30const CREDENTIAL_LIMITS: Limits = Limits {
31    bytes: 524288,
32    allocation: 2097152,
33    nodes: 65536,
34    depth: 32,
35};
36const REPLY_LIMITS: Limits = Limits {
37    bytes: 4096,
38    allocation: 16384,
39    nodes: 128,
40    depth: 8,
41};
42const EMPTY_LIMITS: Limits = Limits {
43    bytes: 11,
44    allocation: 128,
45    nodes: 8,
46    depth: 4,
47};
48
49/// Data-envelope identity, not a callable issuer method or signing format.
50pub struct CredentialEnvelope;
51impl Method for CredentialEnvelope {
52    type Request = PortableCredential;
53    type Response = PortableCredential;
54    const ID: u64 = 0x415554480001;
55    const NAME: &'static str = "credential";
56    const REQUEST_LIMITS: Limits = CREDENTIAL_LIMITS;
57    const RESPONSE_LIMITS: Limits = CREDENTIAL_LIMITS;
58}
59/// Controlled admission contract; consumers bind it to their own update export.
60pub struct EstablishSession;
61impl Method for EstablishSession {
62    type Request = SessionInput;
63    type Response = Result<SessionView, Text<256>>;
64    const ID: u64 = 0x415554480002;
65    const NAME: &'static str = "establish_portable_session";
66    const REQUEST_LIMITS: Limits = CREDENTIAL_LIMITS;
67    const RESPONSE_LIMITS: Limits = REPLY_LIMITS;
68}
69/// Proof-free local read contract; the runtime caller selects the session.
70pub struct ReadSession;
71impl Method for ReadSession {
72    type Request = ();
73    type Response = Result<SessionView, Text<256>>;
74    const ID: u64 = 0x415554480003;
75    const NAME: &'static str = "portable_session_read";
76    const REQUEST_LIMITS: Limits = EMPTY_LIMITS;
77    const RESPONSE_LIMITS: Limits = REPLY_LIMITS;
78}
79/// Caller-authenticated logout; no submitted proof or caller identity is trusted.
80pub struct Logout;
81impl Method for Logout {
82    type Request = ();
83    type Response = LogoutResult;
84    const ID: u64 = 0x415554480004;
85    const NAME: &'static str = "logout_portable_session";
86    const REQUEST_LIMITS: Limits = EMPTY_LIMITS;
87    const RESPONSE_LIMITS: Limits = REPLY_LIMITS;
88}
ic_auth_wire/lib.rs

ic_auth_wire/
lib.rs
