openagent-aegis-core · types

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuthContext {
/// Name of the Auth Provider that validated this credential.

pub provider: String,
/// Unique identifier within the provider's namespace.

pub subject: String,
/// Resolved DID for the authenticated entity.

pub did: Option<String>,
/// Session identifier for stateful authentication.

pub session_id: Option<String>,
/// Expiration time of this authentication context.

pub expires_at: Option<DateTime<Utc>>,
/// Provider-specific claims (opaque to AEGIS core).

#[serde(default)]
pub claims: HashMap<String, serde_json::Value>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AegisIdentity {
/// The entity's DID.

pub did: String,
/// Entity kind (human, agent, organization, delegated).

pub identity_type: IdentityType,
/// Display name if available.

pub display_name: Option<String>,
/// Verified conformance level.

pub conformance_level: Option<u8>
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum IdentityType {
    Human,
    Agent,
    Organization,
    /// Enterprise identity governed by an MHR (ENR entity).
    Enterprise,
    Delegated,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(tag = "type", rename_all = "snake_case")]
pub enum AuthCredential {
    /// Opaque bearer token (OAuth2, JWT).
    BearerToken { token: String },
    /// HTTP session cookie.
    SessionCookie { cookie: String },
    /// Long-lived API key.
    ApiKey { key: String },
    /// Challenge signed with identity key (AEGIS Spec §7.3).
    SignedChallenge {
        did: String,
        challenge: String,
        signature: String,
        timestamp: String,
        nonce: String,
    },
    /// Scoped, time-bounded capability token.
    CapabilityToken { token: String },
    /// WebAuthn/FIDO2 passkey assertion.
    PasskeyAssertion {
        credential_id: String,
        authenticator_data: String,
        client_data_json: String,
        signature: String,
    },
    /// Plugin-defined custom credential type.
    Custom {
        provider: String,
        data: serde_json::Value,
    },
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Session {
/// Unique session identifier.

pub session_id: String,
/// DID of the authenticated entity.

pub did: String,
/// Auth Provider that issued this session.

pub provider: String,
/// Session creation time.

pub created_at: DateTime<Utc>,
/// Session expiration time.

pub expires_at: DateTime<Utc>,
/// Authorized scopes for this session.

#[serde(default)]
pub scope: Vec<String>,
/// Optional device fingerprint binding.

pub device_binding: Option<String>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyRequest {
/// DID of the entity requesting the action.

pub principal: String,
/// The action being requested.

pub action: String,
/// The resource being acted upon.

pub resource: String,
/// Additional context for policy evaluation.

pub context: PolicyContext
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyContext {
/// Authentication context.

pub auth_context: Option<AuthContext>,
/// Verified lineage chain summary.

pub lineage: Option<LineageSummary>,
/// Entity's verified conformance level.

pub conformance_level: Option<u8>,
/// Current session information.

pub session: Option<Session>,
/// Additional key-value context.

#[serde(default)]
pub extra: HashMap<String, serde_json::Value>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct LineageSummary {
/// Number of hops to human root.

pub depth: u32,
/// DID of the human root.

pub human_root: String,
/// Whether the lineage was cryptographically verified.

pub verified: bool
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyDecision {
/// Whether the action is permitted.

pub allowed: bool,
/// Human-readable explanation.

pub reason: Option<String>,
/// Actions that MUST be performed if allowed.

#[serde(default)]
pub obligations: Vec<Obligation>,
/// Audit-relevant metadata.

pub audit_info: AuditInfo
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Obligation {
/// Obligation type.

pub obligation_type: ObligationType,
/// Obligation-specific parameters.

#[serde(default)]
pub params: HashMap<String, serde_json::Value>,
/// Deadline for fulfillment (ISO 8601 duration).

pub deadline: Option<String>
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum ObligationType {
    /// Record the operation in an audit log.
    Log,
    /// Notify the human root or designated monitor.
    Notify,
    /// Obtain explicit approval before proceeding.
    Approve,
    /// Place funds in escrow pending confirmation.
    Escrow,
    /// Apply a rate or amount limit.
    Limit,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuditInfo {
/// Unique ID for this audit event.

pub audit_id: Uuid,
/// Timestamp of the decision.

pub timestamp: DateTime<Utc>,
/// Policy engine that produced the decision.

pub engine: String,
/// Policies that were evaluated.

#[serde(default)]
pub policies_evaluated: Vec<String>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PermissionCheck {
/// DID of the entity.

pub principal: String,
/// The permission to check.

pub permission: String,
/// The resource scope.

pub resource: Option<String>
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum RevocationStatus {
    /// Identity is valid and not revoked.
    Active,
    /// Identity has been explicitly revoked.
    Revoked,
    /// Identity is temporarily suspended.
    Suspended,
    /// Identity has passed its expiration date.
    Expired,
    /// Revocation status cannot be determined.
    Unknown,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum LivenessStatus {
    /// Human root demonstrated liveness within the configured period.
    Active,
    /// Liveness period exceeded — warning issued.
    Warning,
    /// Liveness period significantly exceeded — identity is stale.
    Stale,
    /// Liveness status cannot be determined.
    Unknown,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct VerificationResult {
/// The verified DID.

pub did: String,
/// Whether the document signature is valid.

pub signature_valid: bool,
/// Whether the lineage chain is valid.

pub lineage_valid: bool,
/// Number of hops to human root.

pub lineage_depth: u32,
/// DID of the human root.

pub human_root: Option<String>,
/// Current revocation status.

pub revocation_status: RevocationStatus,
/// Liveness status.

pub liveness_status: LivenessStatus,
/// Verified conformance level (0, 1, or 2).

pub conformance_level: u8,
/// Non-fatal warnings.

#[serde(default)]
pub warnings: Vec<String>,
/// Timestamp of verification.

pub verified_at: DateTime<Utc>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct VerificationConfig {
/// Maximum lineage depth (default: 16).

#[serde(default = "default_max_lineage_depth")]
pub max_lineage_depth: u32,
/// Per-hop timeout in seconds (default: 5).

#[serde(default = "default_per_hop_timeout")]
pub per_hop_timeout_secs: u64,
/// Total verification timeout in seconds (default: 30).

#[serde(default = "default_total_timeout")]
pub total_timeout_secs: u64,
/// Verification cache TTL in seconds (default: 300).

#[serde(default = "default_cache_ttl")]
pub cache_ttl_secs: u64,
/// Liveness period in days (default: 90).

#[serde(default = "default_liveness_period")]
pub liveness_period_days: u32,
/// Conformance level to verify against.

#[serde(default)]
pub conformance_level: u8
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Delegation {
/// Unique delegation identifier.

pub id: String,
/// DID of the entity granting authority.

pub delegator: String,
/// DID of the entity receiving authority.

pub delegate: String,
/// Permitted actions, resources, and constraints.

pub scope: DelegationScope,
/// Delegation creation time.

pub created: DateTime<Utc>,
/// Delegation expiration time.

pub expires: Option<DateTime<Utc>>,
/// Whether the delegation can be revoked before expiration.

pub revocable: bool,
/// Cryptographic proof of the delegation.

pub proof: DelegationProof
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DelegationScope {
/// Permitted actions.

#[serde(default)]
pub actions: Vec<String>,
/// Permitted resources (contract addresses, chain names, etc.).

#[serde(default)]
pub resources: Vec<String>,
/// Permitted blockchain networks.

#[serde(default)]
pub chains: Vec<String>,
/// Quantitative constraints.

pub limits: Option<SpendingLimits>,
/// Time-based constraints.

pub temporal: Option<TemporalConstraints>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SpendingLimits {
/// Maximum value per transaction.

pub max_amount: Option<String>,
/// Maximum aggregate value per 24-hour period.

pub daily_volume: Option<String>,
/// Permitted asset types.

#[serde(default)]
pub asset_allowlist: Vec<String>,
/// Permitted destination addresses.

#[serde(default)]
pub recipient_allowlist: Vec<String>,
/// Value above which owner approval is required.

pub approval_threshold: Option<String>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TemporalConstraints {
/// Policy effective start time.

pub valid_from: Option<DateTime<Utc>>,
/// Policy expiration time.

pub valid_until: Option<DateTime<Utc>>,
/// Time-of-day window (business hours).

pub active_hours: Option<ActiveHours>,
/// Minimum time between successive operations (ISO 8601 duration).

pub cooldown: Option<String>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ActiveHours {
/// Start hour (0–23).

pub start_hour: u8,
/// End hour (0–23).

pub end_hour: u8,
/// Timezone (IANA, e.g. "America/New_York").

pub timezone: String
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DelegationProof {
/// Proof type — always "AegisDelegationProof2025".

#[serde(rename = "type")]
pub proof_type: String,
/// Verification method DID URL.

pub verification_method: String,
/// Proof creation time.

pub created: DateTime<Utc>,
/// Base64url-encoded signature.

pub jws: String
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SessionKey {
/// The temporary signing public key (multibase-encoded).

pub session_key: String,
/// DID of the identity this session key represents.

pub principal: String,
/// Permitted actions and constraints.

pub scope: DelegationScope,
/// Maximum number of operations.

pub max_transactions: Option<u64>,
/// Creation time.

pub created: DateTime<Utc>,
/// Expiration time (REQUIRED, max 24 hours).

pub expires: DateTime<Utc>,
/// Signed by the principal's identity key.

pub proof: DelegationProof
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum WalletType {
    /// Standard private key-controlled address.
    Eoa,
    /// Account abstraction (ERC-4337) with programmable logic.
    Smart,
    /// Chain-native account abstraction (Aptos, Sui, StarkNet).
    Abstract,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum Chain {
    Ethereum,
    Polygon,
    Arbitrum,
    Optimism,
    Base,
    Solana,
    Bitcoin,
    Cosmos,
    Osmosis,
    Aptos,
    Sui,
    Starknet,
}

pub fn coin_type(&self) -> u32;

pub fn derivation_standard(&self) -> &'static str;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum SigningMode {
    /// Single party holds the complete key.
    Direct,
    /// Multiple parties participate via MPC.
    Mpc,
    /// Key resides in a TEE enclave.
    Tee,
    /// External key management system.
    External,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum BatchMode {
    /// All transactions must succeed or none are signed.
    AllOrNothing,
    /// Sign only the authorized transactions.
    BestEffort,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum KeyRole {
    /// Primary signing key for OAS Identity Documents.
    Identity,
    /// Used in challenge-response authentication.
    Authentication,
    /// Signing assertions and attestations.
    Assertion,
    /// Signing delegation proofs.
    Delegation,
    /// Temporary, scoped signing authority.
    Session,
    /// Used in key recovery procedures.
    Recovery,
    /// Signing blockchain transactions.
    Chain,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum KeyGenerationMode {
    /// Single party generates and holds the complete key.
    Direct,
    /// Distributed key generation via MPC.
    Mpc,
    /// Generated inside a TEE enclave.
    Tee,
    /// Generated on an HSM.
    Hsm,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ThresholdConfig {
/// Minimum shares required (t).

pub threshold: u16,
/// Total number of shares (n).

pub total_shares: u16
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Guardian {
/// Guardian type.

pub guardian_type: GuardianType,
/// Guardian identifier (DID, email, phone, or device ID).

pub identifier: String,
/// Weight toward the recovery threshold.

pub weight: u32
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum GuardianType {
    /// OAS identity (DID).
    Identity,
    /// Email address.
    Email,
    /// Phone number.
    Phone,
    /// Hardware device.
    Hardware,
}

pub const MAX_PAGE_SIZE: i64;

pub const DEFAULT_PAGE_SIZE: i64;

#[derive(Debug, Clone, Copy, Serialize, Deserialize)]
pub struct Pagination {
/// Maximum number of items to return (1..=1000).

pub limit: i64,
/// Number of items to skip (>= 0).

pub offset: i64
}

pub fn new(limit: i64, offset: i64) -> Self;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RecoveryConfig {
/// Designated recovery guardians.

pub guardians: Vec<Guardian>,
/// Minimum total weight required for recovery.

pub threshold: u32,
/// Mandatory delay before recovery executes (ISO 8601 duration).

pub timelock: String
}