AshOnetime.KeySource behaviour (ash_onetime v0.4.0)

Closed key-source algebra used by protected actions.

Summary

Functions

Normalizes a key source or list of sources into a validated list.

Extracts the argument and attribute names a list of sources binds, for reference-checking against declared action inputs.

Types

source()

@type source() ::
  {:client, atom()}
  | {:argument, atom()}
  | {:attribute, atom()}
  | {:external, atom()}
  | {:verified, atom(), module()}
  | {:minted, module()}

Callbacks

algorithm()

@callback algorithm() :: :hmac_sha256 | :ed25519

mint(context)

@callback mint(context :: map()) :: {:ok, AshOnetime.Verified.t()} | {:error, term()}

trust_model()

@callback trust_model() :: :same_service | :separated

Functions

normalize(value)

@spec normalize(source() | [source()]) :: {:ok, [source()]} | {:error, String.t()}

Normalizes a key source or list of sources into a validated list.

Enforces five invariants: non-empty (at least one source), at most 16 sources, no nested composites (a source cannot itself be a list), all sources unique, and every source a valid tag (:client/:argument/:attribute/:external/:verified/:minted). A single source is wrapped in a one-element list. Returns {:ok, list} verbatim on success, or {:error, message} naming the violated invariant.

references(sources)

@spec references([source()]) :: %{arguments: [atom()], attributes: [atom()]}

Extracts the argument and attribute names a list of sources binds, for reference-checking against declared action inputs.

:client, :argument, :external, and :verified sources bind argument names; :attribute sources bind attribute names; :minted binds neither (it is a freshly-minted trusted source, not an action input). Returns %{arguments: [atom], attributes: [atom]}.