BoundedAuthorityReportAdapter.
Copy Markdown
View Source
TEST-ONLY reference implementation of the BoundedAuthorityReportAdapter
key-handle behaviour.
The handle term is a {public_key, private_key} tuple of raw 32-byte Ed25519
keys. This compiles ONLY under :test (via mix.exs elixirc_paths) — it
does NOT ship in the artifact.
Why test-only (design C5 / strategy §4 / ADR-0014)
A {pub, priv} tuple puts the private key in process memory as a recoverable
BEAM binary. That posture is acceptable for tests and local development, but
shipping it in lib/ would pave a production road to the exact failure mode
strategy §4 says the separate-repo architecture exists to prevent ("once the
signing key is in the app, extracting it is a re-architecture, not a
refactor"). Production holders implement the callbacks themselves with proper
custody (HSM, OS keychain, a key server) — never this module.
The callbacks match the BoundedAuthorityReportAdapter behaviour contract:
sign/2 performs the :crypto.sign (the holder's job), public_key/1 +
thumbprint/1 expose the public material the adapter needs to build the proof.