arsenal-broker · service
Declared module signatures, types, configuration, and source documentation.
Source: arsenal/crates/arsenal-broker/src/service.rs. SHA-256: fe130c951282730bd7e6bf3e94598bb2f4ce1b1343366db18147306a409479f1.
This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.
service::RegisteredAgent
Registered agent with its identity and metadata
#[derive(Debug, Clone)]
pub struct RegisteredAgent {
/// Agent identity
pub identity: AgentIdentity,
/// Public key bytes for signature verification
pub public_key: [u8; 32],
/// Public key bytes for encryption (X25519)
///
/// Used to encrypt secrets to the agent such that only the agent can unwrap them.
pub encryption_public_key: [u8; 32],
/// Maximum allowed scopes for this agent
pub allowed_scopes: ScopeSet,
/// Maximum token TTL in seconds
pub max_ttl_seconds: i64,
/// Whether `PoP` is required
pub require_pop: bool
}Source line: 46.
service::RequestContext
Request context extracted from the incoming request
#[derive(Debug, Clone)]
pub struct RequestContext {
/// Request ID for tracing
pub request_id: uuid::Uuid,
/// Client IP address
pub client_ip: Option<IpAddr>,
/// User agent string
pub user_agent: Option<String>,
/// Origin header
pub origin: Option<String>,
/// Session ID if provided
pub session_id: Option<SessionId>,
/// Timestamp of the request
pub timestamp: chrono::DateTime<chrono::Utc>
}Source line: 65.
service::RequestContext::new
Create a new request context
#[must_use]
pub fn new() -> Self;Source line: 83.
service::RequestContext::to_constraint_context
Convert to constraint context for validation
#[must_use]
pub fn to_constraint_context(&self) -> ConstraintContext;Source line: 96.
service::CapabilityRequest
Capability request from an agent
#[derive(Debug, Clone)]
pub struct CapabilityRequest {
/// Requested scopes
pub scopes: Vec<String>,
/// Requested TTL in seconds
pub ttl_seconds: Option<i64>,
/// Target audience (service)
pub audience: String,
/// Constraints to apply
pub constraints: Option<Constraints>,
/// `PoP` key fingerprint (if providing `PoP`)
pub pop_key_fingerprint: Option<KeyFingerprint>
}Source line: 119.
service::CapabilityResponse
Capability response
#[derive(Debug, Clone)]
pub struct CapabilityResponse {
/// The issued token ID
pub token_id: TokenId,
/// Serialized token (CBOR, base64 encoded)
pub token: String,
/// Expiration timestamp
pub expires_at: chrono::DateTime<chrono::Utc>,
/// Granted scopes (may be narrower than requested)
pub granted_scopes: Vec<String>
}Source line: 134.
service::SecretRequest
Secret request from an agent
#[derive(Debug, Clone)]
pub struct SecretRequest {
/// Secret ID
pub secret_id: String,
/// Version (optional, defaults to latest)
pub version: Option<u64>,
/// Capability token authorizing access
pub capability_token: String,
/// Proof-of-possession header (base64url JSON), if required by token binding
pub pop_proof: Option<String>
}Source line: 147.
service::WrappedSecretResponse
Wrapped secret response
#[derive(Debug, Clone)]
pub struct WrappedSecretResponse {
/// Secret ID
pub secret_id: String,
/// Version
pub version: u64,
/// Wrapped (encrypted) secret value
pub wrapped_value: String,
/// Wrapping key ID
pub wrap_key_id: String,
/// Ephemeral public key for unwrapping
pub ephemeral_public_key: String,
/// Expiration
pub expires_at: chrono::DateTime<chrono::Utc>
}Source line: 160.
service::BrokerService
The core broker service
pub struct BrokerService {
}Source line: 176.
service::BrokerService::new
Create a new broker service
Errors
Returns an error if initialization fails
#[allow(clippy::too_many_lines)]
pub async fn new(
config: BrokerConfig,
secret_store: Arc<dyn SecretStore>,
audit_sink: Arc<dyn AuditSink>,
) -> ArsenalResult<Self>;Source line: 218.
service::BrokerService::with_signing_key
Create with an existing signing key
Errors
Returns an error if the key is invalid
#[allow(clippy::too_many_lines)]
pub async fn with_signing_key(
config: BrokerConfig,
signing_key_seed: [u8; 32],
secret_store: Arc<dyn SecretStore>,
audit_sink: Arc<dyn AuditSink>,
) -> ArsenalResult<Self>;Source line: 345.
service::BrokerService::check_http_rate_limit
Coarse front-door rate limit for a caller key.
Returns Some(retry_after_seconds) if limited.
pub async fn check_http_rate_limit(&self, key: &str) -> Option<u64>;Source line: 472.
service::BrokerService::register_agent
Register an agent
pub async fn register_agent(&self, agent: RegisteredAgent);Source line: 483.
service::BrokerService::unregister_agent
Unregister an agent
pub async fn unregister_agent(&self, fingerprint: &KeyFingerprint);Source line: 490.
service::BrokerService::get_agent
Get a registered agent by fingerprint
pub async fn get_agent(&self, fingerprint: &KeyFingerprint) -> Option<RegisteredAgent>;Source line: 496.
service::BrokerService::add_policy
Add a policy
pub async fn add_policy(&self, policy: PolicyDocument);Source line: 502.
service::BrokerService::request_capability
Request a capability token
Errors
Returns an error if the request is denied or invalid
#[allow(clippy::too_many_lines)]
pub async fn request_capability(
&self,
agent_fingerprint: &KeyFingerprint,
request: CapabilityRequest,
ctx: &RequestContext,
) -> ArsenalResult<CapabilityResponse>;Source line: 512.
service::BrokerService::request_secret
Request a secret
Errors
Returns an error if access is denied or the secret doesn't exist
#[allow(clippy::too_many_lines)]
pub async fn request_secret(
&self,
agent_fingerprint: &KeyFingerprint,
request: SecretRequest,
ctx: &RequestContext,
) -> ArsenalResult<WrappedSecretResponse>;Source line: 746.
service::BrokerService::revoke_token
Revoke a token
Errors
Returns an error if revocation fails
pub async fn revoke_token(
&self,
agent_fingerprint: &KeyFingerprint,
token_id: &TokenId,
reason: RevocationReason,
ctx: &RequestContext,
) -> ArsenalResult<()>;Source line: 991.
service::BrokerService::verify_token
Verify a token (for external validation)
Errors
Returns an error if the token is invalid
pub async fn verify_token(&self, token_b64: &str) -> ArsenalResult<AgentCapabilityToken>;Source line: 1037.
service::BrokerService::health
Get broker health status
pub async fn health(&self) -> BrokerHealth;Source line: 1108.
service::BrokerService::issue_dct
Issue a Delegated Credential Token (DCT).
Creates a child ACT that grants proxy access to a subset of the parent's delegated variables. The child token inherits the parent's constraints but with narrower scope and shorter TTL.
Errors
Returns an error if:
- The parent token is invalid or expired
- The requested variables are not in the parent's delegated set
- The delegation depth exceeds the maximum
- The requested TTL exceeds the parent's remaining lifetime
child_agent_didnames the token subject;child_agent_idkeys the audit record. Both are required because the audit trail is still keyed by local surrogate, which is tracked for migration to DIDs.
#[allow(clippy::similar_names)]
pub async fn issue_dct(
&self,
parent_token_b64: &str,
delegated_variables: Vec<String>,
child_agent_did: &OasDid,
child_agent_id: &AgentId,
ttl_seconds: i64,
ctx: &RequestContext,
) -> ArsenalResult<(String, chrono::DateTime<chrono::Utc>)>;Source line: 1136.
service::BrokerService::maintain_revocations
Run revocation store maintenance (cleanup + optional compaction).
This is safe to run periodically in the background. Compaction is a no-op for in-memory stores and will rewrite the on-disk snapshot for file-backed stores.
pub async fn maintain_revocations(&self);Source line: 1233.
service::BrokerHealth
Broker health status
#[derive(Debug, Clone, serde::Serialize)]
pub struct BrokerHealth {
/// Status string
pub status: String,
/// Version
pub version: String,
/// Number of registered agents
pub registered_agents: usize,
/// Number of revoked tokens
pub revoked_tokens: usize
}Source line: 1481.