confium_pki/delegation/
operation.rs

1//! Operations that can be delegated.
2
3use serde::{Deserialize, Serialize};
4
5/// An operation that a delegated child cert is authorized to perform.
6#[derive(Debug, Clone, Serialize, Deserialize)]
7#[serde(tag = "kind", rename_all = "snake_case")]
8pub enum Operation {
9    /// Sign another certificate (CA-style delegation).
10    SignCert(SignCertSpec),
11    /// Sign a document (XMLDSig, CMS, raw).
12    SignDocument(SignDocSpec),
13    /// Threshold-sign a message (participate in a quorum).
14    ThresholdSign(ThresholdSignSpec),
15    /// Encrypt a payload to a recipient (e.g., for sealed archival).
16    Encrypt(EncryptSpec),
17}
18
19/// Spec for `SignCert` operations.
20#[derive(Debug, Clone, Serialize, Deserialize, Default)]
21pub struct SignCertSpec {
22    /// Permitted certificate types (e.g., "instance-cert", "sub-ca-cert").
23    pub permitted_cert_types: Vec<String>,
24}
25
26/// Spec for `SignDocument` operations.
27#[derive(Debug, Clone, Serialize, Deserialize, Default)]
28pub struct SignDocSpec {
29    /// Permitted document MIME types.
30    pub permitted_mime_types: Vec<String>,
31    /// Permitted signature formats.
32    pub permitted_formats: Vec<SignatureFormat>,
33}
34
35/// Permitted signature format.
36#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
37#[serde(rename_all = "snake_case")]
38pub enum SignatureFormat {
39    /// Raw signature bytes.
40    Raw,
41    /// CMS / PKCS#7 SignedData.
42    Cms,
43    /// XMLDSig.
44    Xmldsig,
45    /// JWS (JSON Web Signature).
46    Jws,
47    /// COSE (CBOR Object Signing and Encryption).
48    Cose,
49}
50
51/// Spec for `ThresholdSign` operations.
52#[derive(Debug, Clone, Serialize, Deserialize, Default)]
53pub struct ThresholdSignSpec {
54    /// Permitted schemes (e.g., "FROST-ed25519", "CMP20-P256").
55    pub permitted_schemes: Vec<String>,
56}
57
58/// Spec for `Encrypt` operations.
59#[derive(Debug, Clone, Serialize, Deserialize, Default)]
60pub struct EncryptSpec {
61    /// Permitted recipient quorums (by quorum ID).
62    pub permitted_recipients: Vec<String>,
63}
confium_pki/delegation/operation.rs

confium_pki/delegation/
operation.rs
