Source: arsenal/crates/arsenal-broker/src/handlers.rs. SHA-256: 63d254ec9f76e75e17827d465ba1452cbf72386508c7cbf9ca64eea98b5353d1.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

handlers::BrokerState

Shared broker state

pub struct BrokerState {
/// The broker service

pub service: Arc<BrokerService>,
/// Configuration

pub config: BrokerConfig,
/// Proxy service (optional, enabled via config)

pub proxy_service: Option<Arc<ProxyService>>,
/// Consent service (optional, enabled via config)

pub consent_service: Option<Arc<ConsentService>>
}

Source line: 41.

handlers::BrokerState::new

Create new broker state

#[must_use]
pub fn new(service: Arc<BrokerService>, config: BrokerConfig) -> Self;

Source line: 55.

handlers::BrokerState::with_proxy

Create broker state with proxy and consent services

#[must_use]
pub fn with_proxy(
        service: Arc<BrokerService>,
        config: BrokerConfig,
        proxy_service: Option<Arc<ProxyService>>,
        consent_service: Option<Arc<ConsentService>>,
    ) -> Self;

Source line: 66.

handlers::ApiError

API error response

#[derive(Debug, Serialize)]
pub struct ApiError {
/// Error code

pub code: u32,
/// Error message

pub message: String,
/// Correlation ID for tracing

#[serde(skip_serializing_if = "Option::is_none")]
pub correlation_id: Option<String>,
/// Retry after seconds (for rate limiting)

#[serde(skip_serializing_if = "Option::is_none")]
pub retry_after: Option<u64>
}

Source line: 83.

handlers::HealthResponse

Health check response

#[derive(Debug, Serialize)]
pub struct HealthResponse {
/// Service status

pub status: String,
/// Service version

pub version: String,
/// Number of registered agents

pub registered_agents: usize,
/// Number of revoked tokens

pub revoked_tokens: usize
}

Source line: 205.

handlers::health

Health check handler

pub async fn health(State(state): State<Arc<BrokerState>>) -> Json<HealthResponse>;

Source line: 228.

handlers::metrics

Prometheus metrics endpoint.

pub async fn metrics() -> Response;

Source line: 234.

handlers::CapabilityRequestPayload

Capability request payload

#[derive(Debug, Deserialize)]
pub struct CapabilityRequestPayload {
/// Requested scopes

pub scopes: Vec<String>,
/// Requested TTL in seconds

#[serde(default)]
pub ttl_seconds: Option<i64>,
/// Target audience (service)

pub audience: String,
/// Constraints to apply

#[serde(default)]
pub constraints: Option<ConstraintsPayload>,
/// `PoP` key fingerprint (hex encoded)

#[serde(default)]
pub pop_key_fingerprint: Option<String>
}

Source line: 253.

handlers::ConstraintsPayload

Constraints in API format

#[derive(Debug, Default, Deserialize)]
pub struct ConstraintsPayload {
/// Require proof-of-possession

#[serde(default)]
pub require_pop: bool,
/// Allowed origins

#[serde(default)]
pub allowed_origins: Option<Vec<String>>,
/// Device ID binding

#[serde(default)]
pub device_id: Option<String>
}

Source line: 271.

handlers::CapabilityResponsePayload

Capability response payload

#[derive(Debug, Serialize)]
pub struct CapabilityResponsePayload {
/// Token ID

pub token_id: String,
/// Encoded token (base64)

pub token: String,
/// Expiration timestamp (ISO 8601)

pub expires_at: String,
/// Granted scopes

pub granted_scopes: Vec<String>
}

Source line: 304.

handlers::request_capability

Request capability handler

Errors

Returns an ApiError if the capability request is denied or invalid.

pub async fn request_capability(
    State(state): State<Arc<BrokerState>>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    Extension(fingerprint): Extension<KeyFingerprint>,
    headers: HeaderMap,
    Json(payload): Json<CapabilityRequestPayload>,
) -> Result<Json<CapabilityResponsePayload>, ApiError>;

Source line: 331.

handlers::SecretRequestPayload

Secret request payload

#[derive(Debug, Deserialize)]
pub struct SecretRequestPayload {
/// Secret ID

pub secret_id: String,
/// Version (optional, defaults to latest)

#[serde(default)]
pub version: Option<u64>,
/// Capability token authorizing access

pub capability_token: String
}

Source line: 371.

handlers::WrappedSecretResponsePayload

Wrapped secret response payload

#[derive(Debug, Serialize)]
pub struct WrappedSecretResponsePayload {
/// Secret ID

pub secret_id: String,
/// Version

pub version: u64,
/// Wrapped (encrypted) secret value (base64)

pub wrapped_value: String,
/// Wrapping key ID

pub wrap_key_id: String,
/// Ephemeral public key for unwrapping (base64)

pub ephemeral_public_key: String,
/// Expiration timestamp (ISO 8601)

pub expires_at: String
}

Source line: 383.

handlers::request_secret

Request secret handler

Errors

Returns an ApiError if the secret request is denied or the secret is not found.

pub async fn request_secret(
    State(state): State<Arc<BrokerState>>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    Extension(fingerprint): Extension<KeyFingerprint>,
    headers: HeaderMap,
    Json(payload): Json<SecretRequestPayload>,
) -> Result<Json<WrappedSecretResponsePayload>, ApiError>;

Source line: 416.

handlers::RevokeTokenPayload

Token revocation request

#[derive(Debug, Deserialize)]
pub struct RevokeTokenPayload {
/// Token ID to revoke

pub token_id: String,
/// Reason for revocation

#[serde(default)]
pub reason: Option<String>
}

Source line: 480.

handlers::RevokeTokenResponse

Token revocation response

#[derive(Debug, Serialize)]
pub struct RevokeTokenResponse {
/// Whether revocation succeeded

pub success: bool,
/// Message

pub message: String
}

Source line: 490.

handlers::revoke_token

Revoke token handler

Errors

Returns an ApiError if the token ID is invalid or revocation fails.

pub async fn revoke_token(
    State(state): State<Arc<BrokerState>>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    Extension(fingerprint): Extension<KeyFingerprint>,
    headers: HeaderMap,
    Json(payload): Json<RevokeTokenPayload>,
) -> Result<Json<RevokeTokenResponse>, ApiError>;

Source line: 502.

handlers::VerifyTokenPayload

Token verification request

#[derive(Debug, Deserialize)]
pub struct VerifyTokenPayload {
/// Token to verify (base64 encoded)

pub token: String
}

Source line: 547.

handlers::VerifyTokenResponse

Token verification response

#[derive(Debug, Serialize)]
pub struct VerifyTokenResponse {
/// Whether the token is valid

pub valid: bool,
/// Token ID

#[serde(skip_serializing_if = "Option::is_none")]
pub token_id: Option<String>,
/// Subject (agent ID)

#[serde(skip_serializing_if = "Option::is_none")]
pub subject: Option<String>,
/// Audience

#[serde(skip_serializing_if = "Option::is_none")]
pub audience: Option<String>,
/// Expiration timestamp

#[serde(skip_serializing_if = "Option::is_none")]
pub expires_at: Option<String>,
/// Granted scopes

#[serde(skip_serializing_if = "Option::is_none")]
pub scopes: Option<Vec<String>>,
/// Error message if invalid

#[serde(skip_serializing_if = "Option::is_none")]
pub error: Option<String>
}

Source line: 554.

handlers::verify_token

Verify token handler

pub async fn verify_token(
    State(state): State<Arc<BrokerState>>,
    Json(payload): Json<VerifyTokenPayload>,
) -> Json<VerifyTokenResponse>;

Source line: 578.

handlers::ProxyRequestPayload

Proxy request payload

#[derive(Debug, Deserialize)]
pub struct ProxyRequestPayload {
/// HTTP method

pub method: String,
/// Target URL (with {{VARIABLE}} placeholders)

pub url: String,
/// Request headers (may contain {{VARIABLE}} placeholders)

#[serde(default)]
pub headers: Option<std::collections::BTreeMap<String, String>>,
/// Request body (base64 encoded, may contain {{VARIABLE}} placeholders)

#[serde(default)]
pub body: Option<String>,
/// Capability token (base64 encoded ACT)

pub capability_token: String,
/// Request timeout in milliseconds

#[serde(default)]
pub timeout_ms: Option<u64>
}

Source line: 613.

handlers::ProxyResponsePayload

Proxy response payload

#[derive(Debug, Serialize)]
pub struct ProxyResponsePayload {
/// HTTP status code

pub status: u16,
/// Response headers (sanitized)

pub headers: std::collections::BTreeMap<String, String>,
/// Response body (base64 encoded)

pub body: String,
/// Proxy metadata

pub metadata: ProxyMetadataPayload
}

Source line: 633.

handlers::ProxyMetadataPayload

Proxy metadata payload

#[derive(Debug, Serialize)]
pub struct ProxyMetadataPayload {
/// Variable names that were resolved (never values)

pub variables_resolved: Vec<String>,
/// Whether destination binding was verified

pub destination_verified: bool,
/// Whether fingerprint was verified

pub fingerprint_verified: bool,
/// Consent status

pub consent_status: String,
/// Proxy latency in milliseconds

pub latency_ms: u64
}

Source line: 646.

handlers::proxy_request

Proxy request handler

Errors

Returns an ApiError if proxy is disabled, the agent is not registered, or the request fails.

pub async fn proxy_request(
    State(state): State<Arc<BrokerState>>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    Extension(fingerprint): Extension<KeyFingerprint>,
    headers: HeaderMap,
    Json(payload): Json<ProxyRequestPayload>,
) -> Result<Json<ProxyResponsePayload>, ApiError>;

Source line: 664.

handlers::ConsentApprovalPayload

Consent approval payload

#[derive(Debug, Deserialize)]
pub struct ConsentApprovalPayload {
/// Agent DID

pub agent_did: String,
/// Human root DID

pub human_root_did: String,
/// Variables to consent to

pub variables: Vec<String>,
/// Destination domains

pub destination_domains: Vec<String>,
/// Scopes

pub scopes: Vec<String>,
/// Granted by (identifier of the approver)

pub granted_by: String,
/// Expiration in seconds from now

#[serde(default)]
pub expires_in_seconds: Option<u64>,
/// Ed25519 signature (base64 encoded)

pub signature: String
}

Source line: 734.

handlers::ConsentRecordPayload

Consent record response payload

#[derive(Debug, Serialize)]
pub struct ConsentRecordPayload {
/// Consent ID

pub consent_id: String,
/// Agent DID

pub agent_did: String,
/// Human root DID

pub human_root_did: String,
/// Variables

pub variables: Vec<String>,
/// Destination domains

pub destination_domains: Vec<String>,
/// Scopes

pub scopes: Vec<String>,
/// Granted by

pub granted_by: String,
/// Granted at (ISO 8601)

pub granted_at: String,
/// Expires at (ISO 8601)

pub expires_at: String,
/// Whether revoked

pub revoked: bool
}

Source line: 756.

handlers::consent_approve

Approve consent handler

Errors

Returns an ApiError if the consent service is disabled, the agent is not found, or approval fails.

pub async fn consent_approve(
    State(state): State<Arc<BrokerState>>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    Extension(fingerprint): Extension<KeyFingerprint>,
    headers: HeaderMap,
    Json(payload): Json<ConsentApprovalPayload>,
) -> Result<Json<ConsentRecordPayload>, ApiError>;

Source line: 801.

handlers::ConsentDenialPayload

Consent denial payload

#[derive(Debug, Deserialize)]
pub struct ConsentDenialPayload {
/// Agent DID

pub agent_did: String,
/// Human root DID

pub human_root_did: String,
/// Variables being denied

pub variables: Vec<String>,
/// Destination domains

pub destination_domains: Vec<String>,
/// Scopes

pub scopes: Vec<String>
}

Source line: 860.

handlers::consent_deny

Deny consent handler

Errors

Returns an ApiError if the consent service is disabled or the agent is not found.

pub async fn consent_deny(
    State(state): State<Arc<BrokerState>>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    Extension(fingerprint): Extension<KeyFingerprint>,
    headers: HeaderMap,
    Json(payload): Json<ConsentDenialPayload>,
) -> Result<StatusCode, ApiError>;

Source line: 878.

handlers::ConsentRevocationPayload

Consent revocation payload

#[derive(Debug, Deserialize)]
pub struct ConsentRevocationPayload {
/// Consent ID to revoke

pub consent_id: String
}

Source line: 919.

handlers::consent_revoke

Revoke consent handler

Errors

Returns an ApiError if the consent service is disabled, the agent is not found, or revocation fails.

pub async fn consent_revoke(
    State(state): State<Arc<BrokerState>>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    Extension(fingerprint): Extension<KeyFingerprint>,
    headers: HeaderMap,
    Json(payload): Json<ConsentRevocationPayload>,
) -> Result<StatusCode, ApiError>;

Source line: 929.

handlers::ConsentListParams

Consent list query parameters

#[derive(Debug, Deserialize)]
pub struct ConsentListParams {
/// Agent DID to list consents for

pub agent_did: String
}

Source line: 966.

handlers::consent_list

List consents handler

Errors

Returns an ApiError if the consent service is disabled or the query fails.

pub async fn consent_list(
    State(state): State<Arc<BrokerState>>,
    axum::extract::Query(params): axum::extract::Query<ConsentListParams>,
) -> Result<Json<Vec<ConsentRecordPayload>>, ApiError>;

Source line: 976.

arsenal-broker · handlers

On this page