mars-server · federation::envelope

Package: mars-server · Workspace version: 0.1.0 · Module: federation::envelope

This reference follows declared modules and public syntax, including public implementation methods. Function bodies and constant values are omitted. Feature conditions are retained. Private-module re-exports and trait resolution require the compiler; not every declaration is a root import.

federation::envelope::FederationEnvelopeError

Federation authentication or envelope validation failure.

#[derive(Debug, thiserror::Error)]
pub enum FederationEnvelopeError {
    #[error("federation identity is invalid")]
    InvalidIdentity,
    #[error("federation key controller does not match its sender")]
    ControllerMismatch,
    #[error("federation envelope type or version is invalid")]
    InvalidEnvelope,
    #[error("federation envelope request digest is invalid")]
    RequestDigestMismatch,
    #[error("federation envelope clock is outside the accepted window")]
    ClockSkew,
    #[error("federation envelope signature is invalid")]
    InvalidSignature,
    #[error("federation envelope replay detected")]
    Replay,
    #[error("federation trust dependency failed")]
    TrustDependency,
    #[error("federation replay storage failed")]
    ReplayStorage,
}

Source line: 29.

federation::envelope::VerifiedFederationMessage

A verified payload and the MARS-owned principal derived from it.

#[derive(Debug, Clone)]
pub struct VerifiedFederationMessage<T> {
pub payload: T,
pub principal: Principal,
pub envelope_digest: String
}

Source line: 52.

federation::envelope::FederationSigner

Registry signing identity. Private key bytes are zeroized by OasKeyPair and redacted from debug output.

#[derive(Clone)]
pub struct FederationSigner {

}

Source line: 61.

federation::envelope::FederationSigner::new

Construct a signer bound to one canonical OAS service DID.

pub fn new(
        registry_did: impl Into<String>,
        key_id: impl Into<String>,
        keypair: OasKeyPair,
    ) -> Result<Self, FederationEnvelopeError>;

Source line: 80.

federation::envelope::FederationSigner::load_from_config

Load a 32-byte Ed25519 seed from exactly one protected path or environment variable. Input buffers are zeroized after construction.

pub fn load_from_config(
        registry_did: &str,
        config: &FederationConfig,
    ) -> Result<Self, FederationEnvelopeError>;

Source line: 98.

federation::envelope::FederationSigner::registry_did

Canonical sender DID.

pub fn registry_did(&self) -> &str;

Source line: 141.

federation::envelope::FederationSigner::public_key_base64url

Canonical unpadded base64url public key used by the frozen OpenAgent Authorization: OpenAgent <sig>.<pubkey> transport header.

pub fn public_key_base64url(&self) -> String;

Source line: 147.

federation::envelope::FederationSigner::sign_request

Sign a request whose digest is derived from its exact typed payload.

pub fn sign_request<T>(
        &self,
        kind: FederationMessageKind,
        recipient_did: impl Into<String>,
        payload: T,
        timestamp: DateTime<Utc>,
    ) -> Result<SignedFederationEnvelope<T>, FederationEnvelopeError>
    where
        T: Serialize,;

Source line: 181.

federation::envelope::FederationSigner::sign_response

Sign a response and bind it to the full request envelope.

pub fn sign_response<T, R>(
        &self,
        kind: FederationMessageKind,
        request: &SignedFederationEnvelope<R>,
        payload: T,
        timestamp: DateTime<Utc>,
    ) -> Result<SignedFederationEnvelope<T>, FederationEnvelopeError>
    where
        T: Serialize,
        R: Serialize,;

Source line: 208.

federation::envelope::FederationEnvelopeVerifier

Verifies peer envelopes, consumes durable nonces, and derives a scoped federation principal only after every binding succeeds.

#[derive(Clone)]
pub struct FederationEnvelopeVerifier {

}

Source line: 271.

federation::envelope::FederationEnvelopeVerifier::new

pub fn new(
        local_registry_did: impl Into<String>,
        keys: Arc<dyn PublisherKeyResolver>,
        store: Arc<dyn EntryStore>,
        max_clock_skew: Duration,
        nonce_ttl: Duration,
    ) -> Result<Self, FederationEnvelopeError>;

Source line: 281.

federation::envelope::FederationEnvelopeVerifier::with_expected_peer

Pin this verifier to one configured peer identity.

#[must_use]
pub fn with_expected_peer(mut self, peer_did: impl Into<String>) -> Self;

Source line: 308.

federation::envelope::FederationEnvelopeVerifier::verify_request

Verify a signed request and atomically consume its nonce.

pub async fn verify_request<T>(
        &self,
        envelope: &SignedFederationEnvelope<T>,
        expected_kind: FederationMessageKind,
        now: DateTime<Utc>,
    ) -> Result<VerifiedFederationMessage<T>, FederationEnvelopeError>
    where
        T: Serialize + Clone + Sync,;

Source line: 314.

federation::envelope::FederationEnvelopeVerifier::verify_response

Verify a signed response and bind it to the request envelope.

pub async fn verify_response<T, R>(
        &self,
        envelope: &SignedFederationEnvelope<T>,
        expected_kind: FederationMessageKind,
        request: &SignedFederationEnvelope<R>,
        now: DateTime<Utc>,
    ) -> Result<VerifiedFederationMessage<T>, FederationEnvelopeError>
    where
        T: Serialize + Clone + Sync,
        R: Serialize,;

Source line: 334.

federation::envelope::canonical_digest

SHA-256 digest of a typed JCS payload.

pub fn canonical_digest<T: Serialize>(value: &T) -> Result<String, FederationEnvelopeError>;

Source line: 481.

federation::envelope::envelope_digest

SHA-256 digest of the complete canonical signed envelope.

pub fn envelope_digest<T: Serialize>(
    envelope: &SignedFederationEnvelope<T>,
) -> Result<String, FederationEnvelopeError>;

Source line: 487.

Source provenance

Source: mars-server/src/federation/envelope.rs · SHA-256 d066ccafe527ca2681a24c46d2b1511619cd132467921ff8fd458056134bd87f. Package overview.

mars-server · federation::envelope

On this page