systemprompt_cli/shared/
identity.rs

1//! Replica identity secrets: the values every node must share.
2//!
3//! Copyright (c) systemprompt.io — Business Source License 1.1.
4//! See <https://systemprompt.io> for licensing details.
5
6use anyhow::{Context, Result};
7use base64::Engine;
8use serde::Serialize;
9use systemprompt_config::{generate_master_key, generate_seed};
10use systemprompt_security::keys::RsaSigningKey;
11
12use super::profile::generate_oauth_at_rest_pepper;
13
14#[derive(Debug, Clone, Serialize)]
15pub struct IdentityBundle {
16    pub oauth_at_rest_pepper: String,
17    pub manifest_signing_secret_seed: String,
18    pub signing_key_pem: String,
19    pub signing_kid: String,
20    pub encryption_master_key: String,
21}
22
23pub fn generate_identity() -> Result<IdentityBundle> {
24    let key = RsaSigningKey::generate().context("RSA keypair generation failed")?;
25    let pem = key.to_pkcs8_pem().context("PKCS#8 PEM encoding failed")?;
26    let standard = base64::engine::general_purpose::STANDARD;
27    Ok(IdentityBundle {
28        oauth_at_rest_pepper: generate_oauth_at_rest_pepper(),
29        manifest_signing_secret_seed: standard.encode(generate_seed()),
30        signing_key_pem: standard.encode(pem.as_bytes()),
31        signing_kid: key.kid().to_owned(),
32        encryption_master_key: generate_master_key(),
33    })
34}
systemprompt_cli/shared/identity.rs

systemprompt_cli/shared/
identity.rs
