eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add bearer challenge-response proofs

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 19:08:08 +02:00
commit 72cd018a3e
11 changed files with 444 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

98
crates/geth-cli/src/lib.rs
View file

@ -209,6 +209,29 @@ pub enum SecretBearerCommand {
expires_at_ms: Option<i64>,
},
List,
Challenge {
resource: String,
#[arg(long = "capability", required = true)]
capabilities: Vec<String>,
},
Prove {
secret: String,
resource: String,
#[arg(long)]
nonce: String,
#[arg(long = "capability", required = true)]
capabilities: Vec<String>,
},
Verify {
secret: String,
resource: String,
#[arg(long)]
nonce: String,
#[arg(long)]
response: String,
#[arg(long = "capability", required = true)]
capabilities: Vec<String>,
},
Revoke {
resource: String,
secret: String,
@ -606,6 +629,37 @@ fn request_for_command(command: Command) -> Result<ControlRequest> {
expires_at_ms,
},
SecretBearerCommand::List => ControlRequest::SecretBearerList,
SecretBearerCommand::Challenge {
resource,
capabilities,
} => ControlRequest::SecretBearerChallenge {
resource,
capabilities,
},
SecretBearerCommand::Prove {
secret,
resource,
capabilities,
nonce,
} => ControlRequest::SecretBearerProve {
secret,
resource,
capabilities,
nonce,
},
SecretBearerCommand::Verify {
secret,
resource,
capabilities,
nonce,
response,
} => ControlRequest::SecretBearerVerify {
secret,
resource,
capabilities,
nonce,
response,
},
SecretBearerCommand::Revoke { resource, secret } => {
ControlRequest::SecretBearerRevoke { resource, secret }
}
@ -1171,6 +1225,50 @@ fn print_response(response: ControlResponse, json: bool) -> Result<()> {
}
}
}
ControlResponse::SecretBearerChallenge { challenge } => {
println!("bearer challenge");
println!("resource: {}", challenge.resource);
println!("nonce: {}", challenge.nonce);
println!("issued_at_ms: {}", challenge.issued_at.0);
println!(
"capabilities: {}",
challenge
.capabilities
.iter()
.map(ToString::to_string)
.collect::<Vec<_>>()
.join(",")
);
}
ControlResponse::SecretBearerProof { proof } => {
println!("bearer proof");
println!("secret: {}", proof.secret);
println!("resource: {}", proof.resource);
println!("nonce: {}", proof.nonce);
println!("response: {}", proof.response);
println!(
"capabilities: {}",
proof
.capabilities
.iter()
.map(ToString::to_string)
.collect::<Vec<_>>()
.join(",")
);
}
ControlResponse::SecretBearerVerified {
secret,
resource,
capabilities,
verified,
reason,
} => {
println!("bearer verified: {verified}");
println!("secret: {secret}");
println!("resource: {resource}");
println!("capabilities: {}", capabilities.join(","));
println!("reason: {reason}");
}
ControlResponse::SecretBearerRevoked { resource, secret } => {
println!("revoked bearer secret: {secret}");
println!("resource: {resource}");