Extract reusable keychain sigchain model

crates/geth-control/src/lib.rs

@@ -3,7 +3,10 @@ use geth_cas::{FileConflict, FileRoot, FileRootScan};
 use geth_db::{CrSqliteChangeBatch, DbResource};
 use geth_discovery::{DiscoveredPeer, PeerCard};
 use geth_document::{DocumentResource, DocumentState};
-use geth_keychain::{KeychainOp, KeychainOpSignature, NodeEnrollmentRequest, NodeRecord};
+use geth_keychain::{
+    KeychainAllowedSigner, KeychainOp, KeychainOpSignature, KeychainSigchainReport,
+    NodeEnrollmentRequest, NodeRecord,
+};
 use geth_kv::{KvEntry, KvResource, KvSyncEntry};
 use geth_overlay::{
     OverlayInterfacePlan, OverlayJoinPlan, OverlayNetworkStatus, OverlayPacket, OverlayPlan,
@@ -226,6 +229,20 @@ pub enum ControlRequest {
         signing_key_path: Option<PathBuf>,
     },
     KeychainStatus,
+    KeychainAdminAdd {
+        admin_key_path: PathBuf,
+        signing_key_path: PathBuf,
+        principal: Option<String>,
+        valid_after_ms: Option<i64>,
+        valid_before_ms: Option<i64>,
+    },
+    KeychainAdminRevoke {
+        key: String,
+        signing_key_path: PathBuf,
+        admin_key_path: Option<PathBuf>,
+    },
+    KeychainAllowedSigners,
+    KeychainVerify,
     KeychainSync {
         node: String,
     },
@@ -662,6 +679,19 @@ pub enum ControlResponse {
         ops: Vec<KeychainOp>,
         signatures: Vec<KeychainOpSignature>,
     },
+    KeychainAdminUpdated {
+        op: KeychainOp,
+        signatures: Vec<KeychainOpSignature>,
+        note: String,
+    },
+    KeychainAllowedSigners {
+        entries: Vec<KeychainAllowedSigner>,
+        allowed_signers: String,
+        note: String,
+    },
+    KeychainVerified {
+        report: KeychainSigchainReport,
+    },
     KeychainSynced {
         peer_node_id: String,
         peer_agent_id: String,