lexe_common/api/
revocable_clients.rs

1//! The `GetRevocableClientStatus` interface for handshake-time revocation
2//! checks.
3
4use std::fmt;
5
6use lexe_crypto::ed25519;
7
8use crate::time::TimestampMs;
9
10/// A handshake-time validity check for a revocable client cert.
11///
12/// This trait exists mainly so `RevocableClients` can live in `lexe-api-core`
13/// rather than `lexe-common`.
14///
15/// Implemented by `lexe_api_core::revocable_clients::RevocableClientsHandle`.
16pub trait GetRevocableClientStatus: fmt::Debug + Send + Sync {
17    /// The status of the revocable client identified by `client_pk` at `now`,
18    /// or [`None`] if no client with this pubkey exists.
19    fn get_client_status(
20        &self,
21        client_pk: &ed25519::PublicKey,
22        now: TimestampMs,
23    ) -> Option<RevocableClientStatus>;
24}
25
26/// The handshake-time status of a revocable client cert.
27pub enum RevocableClientStatus {
28    /// Not revoked and not expired — accept the cert.
29    ///
30    /// NOTE: This only means that the client is allowed to connect; it does NOT
31    /// mean that the client is *authorized* to do whatever it is asking to do.
32    /// Client scopes and budgets must still be enforced at a higher level.
33    Valid,
34    /// The client was revoked. Revocation is permanent.
35    Revoked,
36    /// The client is expired as of the queried time.
37    Expired,
38}
lexe_common/api/revocable_clients.rs

lexe_common/api/
revocable_clients.rs
