Bootstrap geth Rust workspace

crates/geth-secrets/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "geth-secrets"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[dependencies]
+serde.workspace = true
+thiserror.workspace = true
+geth-types = { path = "../geth-types" }

crates/geth-secrets/src/lib.rs

@@ -0,0 +1,47 @@
+use geth_types::{Capability, PrincipalId, ResourceId, SecretId, UnixMillis};
+use serde::{Deserialize, Serialize};
+
+pub const RESOURCE_SECRET_SIGNATURE_NAMESPACE: &str = "geth.resource-secret.v1@geth.local";
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ResourceMasterSecret {
+    pub id: SecretId,
+    pub resource: ResourceId,
+    pub epoch: u64,
+    pub created_at: UnixMillis,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ResourceKeyEnvelope {
+    pub secret: SecretId,
+    pub recipient: PrincipalId,
+    pub epoch: u64,
+    pub algorithm: String,
+    pub ciphertext: Vec<u8>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct BearerAccess {
+    pub secret: SecretId,
+    pub resource: ResourceId,
+    pub capabilities: Vec<Capability>,
+    pub expires_at: Option<UnixMillis>,
+    pub may_delegate: bool,
+}
+
+impl BearerAccess {
+    #[must_use]
+    pub fn resource_scoped(
+        secret: SecretId,
+        resource: ResourceId,
+        capabilities: Vec<Capability>,
+    ) -> Self {
+        Self {
+            secret,
+            resource,
+            capabilities,
+            expires_at: None,
+            may_delegate: false,
+        }
+    }
+}