Struct DeviceKeyCoseResolver 

pub struct DeviceKeyCoseResolver { /* private fields */ }

Resolves COSE_Sign1 device requests through the service’s cratestack_auth::DeviceKeyResolver (ADR 0006 §8), by its required lookup_device_verifying_keys_by_thumbprint.

What it maps, and why:

• Only Ed25519 (-19). Device keys are Ed25519 keys (the resolver’s type says so). For any other algorithm this returns no candidate without asking the backend, so an ESP256 or HMAC header can neither trigger a device-key lookup nor be verified with a device key.
• Only an 8-byte kid is looked up. The opener never passes another length (the header parser refuses it), but resolve is public; a caller that passes a shorter prefix would otherwise turn one lookup into “every key starting with these bytes”. Anything but KID_LEN bytes gets no candidate and no backend call, which is what lets DeviceKeyResolver’s docs promise implementors exactly 8.
• Unknown or revoked is Ok(vec![]), which the opener turns into the coarse 401, like every other verification failure (§10).
• A backend Err is CratestackError::Internal, so a 500, and its text never reaches the peer (Internal keeps it out of public_message()). Mapping it to “no key” instead would make an outage look like an attack in the logs, and look like an unknown key to the client.
• No kid filtering here. The opener recomputes every candidate’s kid from the key and accepts only the key whose kid is the header’s (open.rs, step 4), so a registry that returns extra keys for a prefix cannot let one device sign as another. Filtering here as well would be a second copy of that check.

Implementations

impl DeviceKeyCoseResolver

pub fn new(devices: Arc<dyn DeviceKeyResolver>) -> DeviceKeyCoseResolver

Trait Implementations

impl Clone for DeviceKeyCoseResolver

fn clone(&self) -> DeviceKeyCoseResolver

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CoseVerifierResolver for DeviceKeyCoseResolver

fn resolve<'life0, 'life1, 'async_trait>( &'life0 self, kid: &'life1 [u8], alg: CoseAlg, ) -> Pin<Box<dyn Future<Output = Result<Vec<CoseVerifyKey>, CratestackError>> + Send + 'async_trait>>

where 'life0: 'async_trait, 'life1: 'async_trait, DeviceKeyCoseResolver: 'async_trait,

Every key whose kid is kid and which verifies alg; Ok(vec![]) if there is none. Err only for a backend failure.

impl Debug for DeviceKeyCoseResolver

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.