openagent-server · challenge

Source: openagents/openagent.id/crates/openagent-server/src/challenge.rs. SHA-256: 2920c158061f341875b5b18dc7b452400506dc614b4bfda7f3e03c88ab021dd0.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

challenge::Challenge

A challenge issued to an unauthenticated agent.

Per OPENAGENT-CORE-SPEC.md §4, the challenge is a JSON object with:

• type: always "openagent-challenge-v1"
• nonce: 32-byte hex string
• timestamp: ISO 8601 UTC
• origin: server origin
• realm: optional realm string

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Challenge {
#[serde(rename = "type")]
pub challenge_type: String,
pub nonce: String,
pub timestamp: String,
pub origin: String,
#[serde(skip_serializing_if = "Option::is_none")]
pub realm: Option<String>
}

Source line: 22.

challenge::Challenge::new

Creates a new challenge with a cryptographically random nonce.

pub fn new(origin: &str, realm: Option<&str>) -> Self;

Source line: 34.

challenge::Challenge::to_jcs_bytes

Serializes this challenge using JCS (RFC 8785) for deterministic signing.

pub fn to_jcs_bytes(&self) -> Result<Vec<u8>, serde_json::Error>;

Source line: 50.

challenge::Challenge::to_base64url

Encodes the challenge as base64url for the WWW-Authenticate header.

pub fn to_base64url(&self) -> Result<String, serde_json::Error>;

Source line: 57.

challenge::hex::encode

pub fn encode(bytes: &[u8]) -> String;

Source line: 65.

challenge::NonceStore

Thread-safe nonce store with TTL-based expiration.

Per OPENAGENT-CORE-SPEC.md §7:

• Nonces are single-use (consumed atomically on verification)
• Nonces expire after a configurable TTL (default 30 seconds)
• Expired nonces are lazily cleaned up

pub struct NonceStore {

}

Source line: 86.

challenge::NonceStore::new

pub fn new(ttl: Duration) -> Self;

Source line: 92.

challenge::NonceStore::issue

Issues a new challenge and stores its nonce.

pub fn issue(&self, origin: &str, realm: Option<&str>) -> Challenge;

Source line: 100.

challenge::NonceStore::consume

Consumes a nonce atomically, returning the original challenge if valid.

Returns None if the nonce is unknown, already consumed, or expired.

pub fn consume(&self, nonce: &str) -> Option<Challenge>;

Source line: 119.