Struct CoseAuthProvider 

pub struct CoseAuthProvider<A> { /* private fields */ }

Wraps an AuthProvider and authenticates a COSE-verified signer through a service key registry and, once switched on, the device key registry.

Each registry must be the one the envelope verifies with, or stricter, so revoking a key there revokes it here. But with_service_keys must hold service keys only (see “Security”): do not pass it a resolver that also holds device keys. The service registry is asked before the device registry, and the device registry only after authenticate_devices.

// Services only (the default): a device key is anonymous.
let provider = CoseAuthProvider::new(header_provider, device_registry)
    .with_service_keys(service_registry);
// Also devices, where device enrolment is gated.
let provider = provider.authenticate_devices(true);

Security

A device key proves a device, not a user, so device authentication is off by default and a device signer is anonymous. With authenticate_devices(true), any request sealed by an enrolled device key is authenticated, with no user (no id_jwt), on every method, regardless of the inner provider’s TransportCallerMode. auth() != null then means “holds an enrolled device or service key”, and revoking the key, not token expiry, is what bounds access. Turn it on only where device enrolment itself is gated. A service key authenticates either way. See the module docs.

with_service_keys must hold service keys only; a device key placed there authenticates as a service whatever the gate. The service registry is asked first and authenticates regardless of authenticate_devices, so passing it the resolver devices enrol into (for example the same RegistryVerifierResolver the envelope verifies with) makes every enrolled device a kind: service caller with the gate off.

An ESP256 or WebCrypto device key can authenticate only through the service registry (not behind the device gate), because DeviceKeyResolver is Ed25519-only.

The id is cose:<thumbprint> only with the default ThumbprintPrincipal prefix. The context also carries kind, thumbprint and alg.

Implementations

impl<A> CoseAuthProvider<A>

pub fn new(inner: A, devices: Arc<dyn DeviceKeyResolver>) -> CoseAuthProvider<A>

Wrap inner. devices, a [DeviceKeyResolver] (its thumbprint lookup is the one used), is consulted only after authenticate_devices(true).

pub fn authenticate_devices(self, enabled: bool) -> CoseAuthProvider<A>

Switch device authentication on or off (off by default).

Off, a verified device signer is anonymous: the device registry is not asked and policy refuses it (a failing service registry, asked first, still errors with 500). On, a device key the registry still holds authenticates as kind device (see the type docs, “Security”: this makes the key alone a caller). Service keys (with_service_keys) are not affected.

pub fn with_service_keys( self, services: Arc<dyn CoseVerifierResolver>, ) -> CoseAuthProvider<A>

Also authenticate verified service keys, which services holds under any algorithm it verifies (for example a RegistryVerifierResolver). services must hold service keys only: a device key here authenticates as a service whatever the gate.

Trait Implementations

impl<A> AuthProvider for CoseAuthProvider<A>

where A: AuthProvider,

type Error = CratestackError

async fn authenticate( &self, request: &RequestContext<'_>, ) -> Result<CratestackContext, CratestackError>

fn credential<'r>(&self, request: &RequestContext<'r>) -> Credential<'r>

Whether request carries this provider’s credential, read from the request head without authenticating (the body may be empty). The first-success chain skips a provider that answers [Credential::Absent]. The default, [Credential::Unknown], means the provider is always called, as before this method existed. See [Credential].

impl<A> Clone for CoseAuthProvider<A>

where A: Clone,

fn clone(&self) -> CoseAuthProvider<A>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<A> Debug for CoseAuthProvider<A>

where A: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.