|
| 1 | +//! Fixed confidential native config cipher contract. No plaintext return member. |
| 2 | +use crate::AuditCorrelation2; |
| 3 | +use serde::{Deserialize, Serialize}; |
| 4 | +/// Init-only consumer bound to one registered `ConfigUserMaster` authority. |
| 5 | +#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)] |
| 6 | +#[serde(deny_unknown_fields)] |
| 7 | +pub struct SecretCipherConfig2 { |
| 8 | + /// Exact existing native master registration. |
| 9 | + pub registration_id: String, |
| 10 | + /// Opaque fixed consumer identity; no caller-selected endpoint. |
| 11 | + pub consumer_id: String, |
| 12 | + /// Immutable encryption setting. |
| 13 | + pub enabled: bool, |
| 14 | + /// Physical receiver slots, each independently bounded and never overwritten. |
| 15 | + pub slots: u16, |
| 16 | + /// Fixed confidential callback timeout, 1..=30000 milliseconds. |
| 17 | + pub timeout_ms: u32, |
| 18 | +} |
| 19 | +/// Exact routine operation, never a master-resolution or approval-recovery method. |
| 20 | +#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)] |
| 21 | +#[serde(rename_all = "snake_case")] |
| 22 | +pub enum SecretCipherKind2 { |
| 23 | + /// Encrypt, including historical empty/disabled compatibility. |
| 24 | + Encrypt, |
| 25 | + /// Decrypt, including legacy and plaintext compatibility. |
| 26 | + Decrypt, |
| 27 | + /// Decrypt and optionally produce a legacy replacement. |
| 28 | + DecryptAndMigrate, |
| 29 | +} |
| 30 | +/// Confidential input; receivers must immediately move it into zeroizing ownership. |
| 31 | +#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)] |
| 32 | +#[serde(deny_unknown_fields)] |
| 33 | +pub struct SecretCipherRequest2 { |
| 34 | + /// Exact initialized registration. |
| 35 | + pub registration_id: String, |
| 36 | + /// Selected existing private native master alias. |
| 37 | + pub master_handle: String, |
| 38 | + /// Bounded original native call identity. |
| 39 | + pub call_id: String, |
| 40 | + /// Immutable operation. |
| 41 | + pub operation: SecretCipherKind2, |
| 42 | + /// UTF-8 confidential input, bounded by the native cipher owner. |
| 43 | + pub input: Vec<u8>, |
| 44 | + /// Shortening deadline; never renews the selected master. |
| 45 | + pub ttl_ms: u32, |
| 46 | +} |
| 47 | +/// Required exact intent audit and confidential routine input. |
| 48 | +#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)] |
| 49 | +#[serde(deny_unknown_fields)] |
| 50 | +pub struct EvaluateSecretCipherRequest2 { |
| 51 | + /// Exact original request. |
| 52 | + pub request: SecretCipherRequest2, |
| 53 | + /// Required intent audit. |
| 54 | + pub audit: AuditCorrelation2, |
| 55 | +} |
| 56 | +/// Opaque process-ephemeral pending identity; strings alone grant no authority. |
| 57 | +#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)] |
| 58 | +#[serde(deny_unknown_fields)] |
| 59 | +pub struct SecretCipherPending2 { |
| 60 | + /// Owner-minted once-only private pending lookup. |
| 61 | + pub pending_id: String, |
| 62 | + /// Original absolute deadline. |
| 63 | + pub expires_at_ms: u64, |
| 64 | +} |
| 65 | +/// Consume private pending with unchanged request and ordered actual audit phases. |
| 66 | +#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)] |
| 67 | +#[serde(deny_unknown_fields)] |
| 68 | +pub struct ExecuteSecretCipherRequest2 { |
| 69 | + /// Unchanged original confidential request. |
| 70 | + pub request: SecretCipherRequest2, |
| 71 | + /// Exact owner-minted pending identity. |
| 72 | + pub pending_id: String, |
| 73 | + /// Required pre-execution audit. |
| 74 | + pub audit: AuditCorrelation2, |
| 75 | + /// Required output-stage audit (also persisted for ciphertext). |
| 76 | + pub delivery_audit: AuditCorrelation2, |
| 77 | + /// Required final publication audit. |
| 78 | + pub completion_audit: AuditCorrelation2, |
| 79 | +} |
| 80 | +/// Exact private receiver slot identity. Echo alone is not completion proof. |
| 81 | +#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)] |
| 82 | +#[serde(deny_unknown_fields)] |
| 83 | +pub struct SecretCipherDeliveryIdentity2 { |
| 84 | + /// Fixed initialized consumer. |
| 85 | + pub consumer_id: String, |
| 86 | + /// Fixed initialized registration. |
| 87 | + pub registration_id: String, |
| 88 | + /// Original operation correlation, keyed by the owner. |
| 89 | + pub operation_id: String, |
| 90 | + /// Distinct keyed exact-output commitment. |
| 91 | + pub output_id: String, |
| 92 | + /// Current owner generation. |
| 93 | + pub generation: u64, |
| 94 | + /// Exact original operation. |
| 95 | + pub operation: SecretCipherKind2, |
| 96 | + /// Physical fixed receiver slot index. |
| 97 | + pub slot: u16, |
| 98 | + /// Original deadline; late staging never permits publication. |
| 99 | + pub expires_at_ms: u64, |
| 100 | +} |
| 101 | +/// Confidential staged output. Trusted receiver stores it only in a zeroizing slot. |
| 102 | +/// The receiver authorizes the actual pinned module sender and refuses overwrite. |
| 103 | +/// It releases output only after the matching successful owner response, wipes on |
| 104 | +/// denial/cancellation, and performs all work inside the callback future. |
| 105 | +#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)] |
| 106 | +#[serde(deny_unknown_fields)] |
| 107 | +pub struct SecretCipherDeliveryRequest2 { |
| 108 | + /// Exact captured destination/output binding. |
| 109 | + pub identity: SecretCipherDeliveryIdentity2, |
| 110 | + /// Confidential output; never ordinary bus result. |
| 111 | + pub plaintext: Vec<u8>, |
| 112 | + /// Disabled migration replacements also remain confidential. |
| 113 | + pub replacement: Option<Vec<u8>>, |
| 114 | +} |
| 115 | +/// Actual trusted native callback completion, not a caller-created receipt. |
| 116 | +#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)] |
| 117 | +#[serde(deny_unknown_fields)] |
| 118 | +pub struct SecretCipherDeliveryResponse2 { |
| 119 | + /// Exact completed stage identity. |
| 120 | + pub identity: SecretCipherDeliveryIdentity2, |
| 121 | + /// True only after work completed and the exclusive physical slot owns output. |
| 122 | + pub staged: bool, |
| 123 | +} |
| 124 | +/// Classified safe result; plaintext remains in the fixed trusted native slot. |
| 125 | +#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)] |
| 126 | +#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)] |
| 127 | +pub enum SecretCipherResponse2 { |
| 128 | + /// Only true nonempty enabled encryption returns ordinary ciphertext. |
| 129 | + Ciphertext { |
| 130 | + /// Authenticated enc2 envelope. |
| 131 | + ciphertext: String, |
| 132 | + }, |
| 133 | + /// Successful owner response permits local consumption of this exact slot. |
| 134 | + Delivered { |
| 135 | + /// Exact identity of privately staged output. |
| 136 | + identity: SecretCipherDeliveryIdentity2, |
| 137 | + /// Whether legacy replacement was produced. |
| 138 | + migrated: bool, |
| 139 | + /// True encrypted replacement only; disabled replacement stays in slot. |
| 140 | + replacement_ciphertext: Option<String>, |
| 141 | + }, |
| 142 | +} |
| 143 | +macro_rules! redacted { |
| 144 | + ($($ty:ty),*) => {$ (impl std::fmt::Debug for $ty { |
| 145 | + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { |
| 146 | + f.write_str(concat!(stringify!($ty), "([REDACTED])")) |
| 147 | + } |
| 148 | + })*}; |
| 149 | +} |
| 150 | +redacted!( |
| 151 | + SecretCipherConfig2, |
| 152 | + SecretCipherRequest2, |
| 153 | + EvaluateSecretCipherRequest2, |
| 154 | + SecretCipherPending2, |
| 155 | + ExecuteSecretCipherRequest2, |
| 156 | + SecretCipherDeliveryIdentity2, |
| 157 | + SecretCipherDeliveryRequest2, |
| 158 | + SecretCipherDeliveryResponse2, |
| 159 | + SecretCipherResponse2 |
| 160 | +); |
| 161 | + |
| 162 | +#[cfg(test)] |
| 163 | +#[path = "secret_cipher_tests.rs"] |
| 164 | +mod tests; |
0 commit comments