openagent-auth-protocol · handshake

Source: openagent-sdk/crates/openagent-auth-protocol/src/handshake.rs. SHA-256: 45c722316200bf93f48609255516c92106a0cb15ca1741a777f02c4f7c7941a9.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

handshake::DEFAULT_SESSION_TTL_SECS

Default session TTL in seconds (5 minutes).

pub const DEFAULT_SESSION_TTL_SECS: u32;

Source line: 13.

handshake::DEFAULT_CHALLENGE_TTL_SECS

Default challenge TTL in seconds (Section 7: default 30s, max 300s).

pub const DEFAULT_CHALLENGE_TTL_SECS: u32;

Source line: 16.

handshake::MAX_CHALLENGE_TTL_SECS

Maximum challenge TTL in seconds (Section 7).

pub const MAX_CHALLENGE_TTL_SECS: u32;

Source line: 19.

handshake::WELL_KNOWN_PATH

Well-known path for discovery.

pub const WELL_KNOWN_PATH: &str;

Source line: 22.

handshake::AUTH_ENDPOINT_PATH

Well-known path for the auth endpoint.

pub const AUTH_ENDPOINT_PATH: &str;

Source line: 25.

handshake::PROVE_ENDPOINT_PATH

Well-known path for the prove endpoint.

pub const PROVE_ENDPOINT_PATH: &str;

Source line: 28.

handshake::generate_nonce

Generate a nonce per Section 7: 32 CSPRNG bytes as 64 lowercase hex chars.

pub fn generate_nonce() -> Result<String, AuthProtocolError>;

Source line: 31.

handshake::new_challenge

Construct a fresh [IdentityChallenge] for origin, stamping the current UTC time in the Section 4 format (Z suffix, seconds precision).

pub fn new_challenge(
    origin: &str,
    realm: Option<String>,
) -> Result<IdentityChallenge, AuthProtocolError>;

Source line: 39.

handshake::canonical_challenge_bytes

The signing payload for an [IdentityProof]: the JCS-canonicalized (RFC 8785) UTF-8 bytes of the challenge object, with no framing, prefix, or envelope (Section 5 / Section 15.2).

pub fn canonical_challenge_bytes(
    challenge: &IdentityChallenge,
) -> Result<Vec<u8>, AuthProtocolError>;

Source line: 56.

handshake::validate_challenge

Validate an [IdentityChallenge] against the Section 4 field constraints.

A server MUST reject a challenge whose type differs, and an agent MUST reject a malformed challenge before signing it: signing binds the agent to these exact bytes.

pub fn validate_challenge(challenge: &IdentityChallenge) -> Result<(), AuthProtocolError>;

Source line: 77.

handshake::validate_nonce

The nonce field: exactly 64 lowercase hex characters (Section 7).

pub fn validate_nonce(nonce: &str) -> Result<(), AuthProtocolError>;

Source line: 100.

handshake::validate_timestamp

The timestamp field: ISO 8601 UTC with Z suffix and seconds precision (Section 4.2). Fractional seconds and numeric offsets are rejected.

pub fn validate_timestamp(timestamp: &str) -> Result<(), AuthProtocolError>;

Source line: 118.

handshake::validate_origin

The origin field: scheme://host[:port] per RFC 6454 (Section 4.2).

pub fn validate_origin(origin: &str) -> Result<(), AuthProtocolError>;

Source line: 131.

handshake::validate_proof_shape

Validate an [IdentityProof] against a challenge (Section 15.3): the echoed nonce must match, and the key shape must match the declared scheme. Signature verification itself belongs to the verifier, which knows the trusted key set.

pub fn validate_proof_shape(
    proof: &IdentityProof,
    challenge: &IdentityChallenge,
) -> Result<(), AuthProtocolError>;

Source line: 150.