Trait ResponseSealPolicy

Source

pub trait ResponseSealPolicy:
    Send
    + Sync
    + 'static {
    // Required method
    fn seal_unsigned(&self, request: &UnsignedRequest<'_>) -> bool;
}

Expand description

Decides whether the response to an unsigned request is sealed, under Optional. The default is AcceptNamesEnvelope (D10). A closure is a policy (second-review nit):

use cratestack_axum::envelope_layer::{EnvelopeLayerBuilder, UnsignedRequest};

fn reads_only(builder: EnvelopeLayerBuilder) -> EnvelopeLayerBuilder {
    builder.response_seal_policy(|r: &UnsignedRequest<'_>| {
        r.accept_names_envelope() && r.method().as_str() == "GET"
    })
}

Such a seal binds the client’s Cratestack-Nonce and the request payload, and nothing about the caller: the request was not signed, so the response proves only that this server answered this nonce and body, not who asked. A client must not read it as an authenticated exchange.

What the layer enforces whatever this returns: it is asked only under Optional, only about an unsigned request, and only when that request carries a well-formed Cratestack-Nonce (without one the response could not be bound to this request, and a cached one could be replayed for the next). A signed request’s response is always sealed, and under Required every response is: neither is this policy’s call.