Secret-free binding between one ASM managed-session generation and one Jido credential materialization.
Jido owns lease redemption and the transient SecretMaterial. ASM retains
only the exact identity, generation, authority, target, workspace digest,
and expiry needed to prevent a live session from switching accounts or
being reused after its materialization has closed.
Summary
Types
@type t() :: %ASM.RuntimeAuth.ManagedBinding{ asm_session_id: String.t(), authority_ref: String.t(), connector_binding_ref: String.t(), connector_instance_ref: String.t(), credential_generation: pos_integer(), effect_ref: String.t(), endpoint_ref: String.t(), execution_context_ref: String.t(), expires_at: DateTime.t(), fence: non_neg_integer(), issued_at: DateTime.t(), lease_ref: String.t(), materialization_ref: String.t(), native_auth_assertion_ref: String.t(), operation_policy_ref: String.t(), operation_ref: String.t(), provider_account_ref: String.t(), provider_family: String.t(), runtime_gateway_module: module() | nil, runtime_gateway_ref: String.t(), session_generation: pos_integer(), session_ref: String.t(), target_ref: String.t(), workspace_digest: String.t(), workspace_ref: String.t() }
Functions
@spec active(t(), DateTime.t()) :: :ok | {:error, ASM.Error.t()}
@spec authorize_revocation(t(), map() | keyword()) :: :ok | {:error, ASM.Error.t()}
@spec material_payload(keyword()) :: {:ok, map()} | {:error, ASM.Error.t()}
@spec new(atom(), ASM.RuntimeAuth.t(), keyword()) :: {:ok, t() | nil} | {:error, ASM.Error.t()}
@spec remaining_ms(t(), DateTime.t()) :: non_neg_integer()
@spec revalidate(t(), ASM.RuntimeAuth.t(), keyword()) :: :ok | {:error, ASM.Error.t()}