systemprompt_cli/shared/
identity.rs

1//! Replica identity secrets: the three values every node must share.
2//!
3//! Copyright (c) systemprompt.io — Business Source License 1.1.
4//! See <https://systemprompt.io> for licensing details.
5
6use anyhow::{Context, Result};
7use base64::Engine;
8use serde::Serialize;
9use systemprompt_config::generate_seed;
10use systemprompt_security::keys::RsaSigningKey;
11
12use super::profile::generate_oauth_at_rest_pepper;
13
14#[derive(Debug, Clone, Serialize)]
15pub struct IdentityBundle {
16    pub oauth_at_rest_pepper: String,
17    pub manifest_signing_secret_seed: String,
18    pub signing_key_pem: String,
19    pub signing_kid: String,
20}
21
22pub fn generate_identity() -> Result<IdentityBundle> {
23    let key = RsaSigningKey::generate().context("RSA keypair generation failed")?;
24    let pem = key.to_pkcs8_pem().context("PKCS#8 PEM encoding failed")?;
25    let standard = base64::engine::general_purpose::STANDARD;
26    Ok(IdentityBundle {
27        oauth_at_rest_pepper: generate_oauth_at_rest_pepper(),
28        manifest_signing_secret_seed: standard.encode(generate_seed()),
29        signing_key_pem: standard.encode(pem.as_bytes()),
30        signing_kid: key.kid().to_owned(),
31    })
32}
systemprompt_cli/shared/identity.rs

systemprompt_cli/shared/
identity.rs
