openagent-mcp · types

pub type Did = String;

#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
pub struct Identity {
/// Caller's DID.

pub did: Did,
/// Verifiable proof — opaque to the middleware.

pub proof: String,
/// Optional bearer-style nonce for replay protection.

#[serde(default, skip_serializing_if = "Option::is_none")]
pub nonce: Option<String>,
/// Optional context fields the verifier may use (issuer DID,

/// audience, claimed scopes). Always validated against the verifier

/// policy — never trusted as input.

#[serde(default, skip_serializing_if = "Option::is_none")]
pub context: Option<serde_json::Value>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct VerifiedIdentity {
/// Verified DID.

pub did: Did,
/// Scopes the caller actually holds (post-verification).

pub scopes: Vec<String>,
/// Audit identifier echoed back to the caller in the response.

pub audit_id: String,
/// Verifier-issued claims about the caller.

pub claims: serde_json::Value
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuditMeta {
/// Identifier for correlating logs end-to-end.

pub audit_id: String,
/// DID of the caller that was successfully verified.

pub verified_did: Did,
/// Scopes the caller exercised on this call.

pub scopes: Vec<String>
}

#[async_trait]
pub trait IdentityVerifier: Send + Sync {
    /// Verify the supplied identity envelope and return the resulting
    /// [`VerifiedIdentity`]. Implementations MUST be deterministic for a
    /// given `(identity, required_scopes)` pair and MUST NOT mutate
    /// either argument.
    async fn verify(
        &self,
        identity: &Identity,
        required_scopes: &[String],
    ) -> Result<VerifiedIdentity, McpAuthError>;
}

#[async_trait]
pub trait Agent: Send + Sync {
    /// The agent's own DID.
    fn did(&self) -> &str;

    /// The verifier the agent's MCP server uses to authenticate
    /// inbound calls.
    fn verifier(&self) -> Arc<dyn IdentityVerifier>;

    /// Sign an outbound call so the receiving server can authenticate
    /// the agent. Returns the identity envelope to attach to the
    /// request `_meta.openagent.identity` field.
    async fn sign_request(
        &self,
        tool_name: &str,
        audience: Option<&str>,
    ) -> Result<Identity, McpAuthError>;
}

pub type ScopeDeriver =
    Arc<dyn Fn(&str, &serde_json::Value) -> Vec<String> + Send + Sync>;

pub type PreCallHook = Arc<
    dyn Fn(&PreCallContext<'_>) -> futures_compat::BoxFuture<'static, ()> + Send + Sync,
>;

pub type PostCallHook = Arc<
    dyn Fn(&PostCallContext<'_>) -> futures_compat::BoxFuture<'static, ()> + Send + Sync,
>;

pub type ErrorHook = Arc<
    dyn Fn(&ErrorContext<'_>) -> futures_compat::BoxFuture<'static, ()> + Send + Sync,
>;

#[derive(Debug)]
pub struct PreCallContext<'a> {
/// The tool name.

pub tool_name: &'a str,
/// Arguments the caller supplied.

pub args: &'a serde_json::Value,
/// The verified identity.

pub identity: &'a VerifiedIdentity
}

#[derive(Debug)]
pub struct PostCallContext<'a> {
/// The tool name.

pub tool_name: &'a str,
/// Arguments the caller supplied.

pub args: &'a serde_json::Value,
/// The verified identity.

pub identity: &'a VerifiedIdentity,
/// Wall-clock duration of the call, in milliseconds.

pub duration_ms: u128,
/// The successful tool result, after audit metadata stamping.

pub result: &'a serde_json::Value
}

#[derive(Debug)]
pub struct ErrorContext<'a> {
/// The tool name.

pub tool_name: &'a str,
/// Arguments the caller supplied.

pub args: &'a serde_json::Value,
/// The verified identity, if the auth pipeline got far enough to

/// produce one.

pub identity: Option<&'a VerifiedIdentity>,
/// The error that aborted the call.

pub error: &'a McpAuthError
}

#[derive(Clone)]
pub struct Config {

}

pub fn new(agent: Arc<dyn Agent>) -> Self;

pub fn with_require_scopes(mut self, deriver: ScopeDeriver) -> Self;

pub fn with_require_identity(mut self, require: bool) -> Self;

pub fn with_skills_policy(mut self, policy: SkillsPolicy) -> Self;

pub fn with_pre_call(mut self, hook: PreCallHook) -> Self;

pub fn with_post_call(mut self, hook: PostCallHook) -> Self;

pub fn with_on_error(mut self, hook: ErrorHook) -> Self;

pub fn with_extra(mut self, key: impl Into<String>, value: serde_json::Value) -> Self;

pub fn agent(&self) -> &Arc<dyn Agent>;

pub mod futures_compat;

pub type BoxFuture<'a, T> = Pin<Box<dyn Future<Output = T> + Send + 'a>>;