microvms_app/agents/
bedrock.rs

1// SPDX-License-Identifier: Apache-2.0
2//! A Bedrock bearer token, and how long it lives (AGENT-4).
3//!
4//! Minting one signs a SigV4 query presign with the caller's AWS credentials, which reaches
5//! the credential chain, so the minter is in `microvms-edges` (at
6//! `microvms_core::agents::bedrock::mint`). This module holds what the agent helpers carry.
7//!
8//! # The token is a credential
9//!
10//! [`BearerToken`]'s `Debug` is written by hand and prints its length and nothing else,
11//! because a derived one would put the token in every log line that formats it. It
12//! reaches the guest as a file over the authenticated channel and never as an argv
13//! element or an env var on the wire.
14
15use std::time::{Duration, SystemTime};
16
17/// The reference implementation's `TOKEN_DURATION`: the default and the ceiling.
18pub const MAX_LIFETIME: Duration = Duration::from_secs(43_200);
19
20/// A minted bearer token. Opaque; `Debug` shows only the length.
21#[derive(Clone, PartialEq, Eq)]
22pub struct BearerToken(String);
23
24impl BearerToken {
25    /// Wraps a minted token's text. The minter builds one; so can a test that needs a token
26    /// shaped value without signing anything.
27    pub fn new(token: String) -> Self {
28        Self(token)
29    }
30
31    /// The token text, for writing into the guest's environment file.
32    pub fn expose(&self) -> &str {
33        &self.0
34    }
35}
36
37impl std::fmt::Debug for BearerToken {
38    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
39        write!(f, "BearerToken(<{} bytes>)", self.0.len())
40    }
41}
42
43/// A token and when it stops working.
44#[derive(Clone, Debug)]
45pub struct Minted {
46    pub token: BearerToken,
47    /// The earlier of the presign expiry and the known signing credential expiry.
48    /// With credentials lacking expiry metadata, this remains only an upper bound.
49    pub expires_at: SystemTime,
50}
microvms_app/agents/bedrock.rs

microvms_app/agents/
bedrock.rs
