vta_sdk/protocols/key_management/
sign.rs

1use serde::{Deserialize, Serialize};
2
3/// Signing algorithms supported by the VTA sign-request protocol.
4#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
5#[serde(rename_all = "lowercase")]
6#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
7pub enum SignAlgorithm {
8    /// Ed25519 / EdDSA signing.
9    EdDSA,
10    /// ECDSA with P-256 / ES256 signing.
11    ES256,
12}
13
14/// Body of a sign-request message.
15#[derive(Debug, Clone, Serialize, Deserialize)]
16#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
17pub struct SignRequestBody {
18    /// Key ID to sign with. Must be **active**, and the consumer enforces the
19    /// caller's authority over it — this is not merely a caller-side
20    /// precondition.
21    ///
22    /// Because the VTA signs the bytes it is given without inspecting them,
23    /// *which keys a caller may name* is the whole of the authorization story,
24    /// so callers reasoning about identity separation depend on it. The
25    /// guarantee, in order: the caller must be authorized in the key's context;
26    /// the context's `signable_keys` policy must permit the key (binding even a
27    /// super-admin); and a key with no context is super-admin-only.
28    ///
29    /// **Scoped per context, not per key id** — holding a context authorizes
30    /// every key in it, so a signer acting for several identities needs a
31    /// context each. See `docs/02-vta/integration-guide.md` §"What authorizes a
32    /// sign request".
33    pub key_id: String,
34    /// Base64url-encoded payload bytes to sign.
35    pub payload: String,
36    /// Signing algorithm to use (must match the key type).
37    pub algorithm: SignAlgorithm,
38}
39
40/// Body of a sign-result message.
41#[derive(Debug, Clone, Serialize, Deserialize)]
42#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
43pub struct SignResultBody {
44    /// Key ID that was used.
45    pub key_id: String,
46    /// Base64url-encoded signature bytes.
47    pub signature: String,
48    /// Algorithm used.
49    pub algorithm: SignAlgorithm,
50}
51
52impl std::fmt::Display for SignAlgorithm {
53    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
54        match self {
55            SignAlgorithm::EdDSA => write!(f, "eddsa"),
56            SignAlgorithm::ES256 => write!(f, "es256"),
57        }
58    }
59}
vta_sdk/protocols/key_management/sign.rs

vta_sdk/protocols/key_management/
sign.rs
