Add bearer challenge-response proofs

crates/geth-control/src/lib.rs

@@ -8,7 +8,7 @@ use geth_kv::{KvEntry, KvResource, KvSyncEntry};
 use geth_pipe::{PipeConnection, PipeListener};
 use geth_pubsub::PubsubMessage;
 use geth_resource::ResourceDescriptor;
-use geth_secrets::{BearerAccess, ResourceMasterSecret};
+use geth_secrets::{BearerAccess, BearerChallenge, BearerProof, ResourceMasterSecret};
 use geth_ssh_identity::{
     SshCertApproval, SshCertRequest, SshCertificateRecord, SshRevocationEntry,
 };
@@ -115,6 +115,23 @@ pub enum ControlRequest {
         expires_at_ms: Option<i64>,
     },
     SecretBearerList,
+    SecretBearerChallenge {
+        resource: String,
+        capabilities: Vec<String>,
+    },
+    SecretBearerProve {
+        secret: String,
+        resource: String,
+        capabilities: Vec<String>,
+        nonce: String,
+    },
+    SecretBearerVerify {
+        secret: String,
+        resource: String,
+        capabilities: Vec<String>,
+        nonce: String,
+        response: String,
+    },
     SecretBearerRevoke {
         resource: String,
         secret: String,
@@ -384,6 +401,19 @@ pub enum ControlResponse {
     SecretBearerList {
         access: Vec<BearerAccess>,
     },
+    SecretBearerChallenge {
+        challenge: BearerChallenge,
+    },
+    SecretBearerProof {
+        proof: BearerProof,
+    },
+    SecretBearerVerified {
+        secret: String,
+        resource: String,
+        capabilities: Vec<String>,
+        verified: bool,
+        reason: String,
+    },
     SecretBearerRevoked {
         resource: String,
         secret: String,
@@ -943,6 +973,30 @@ mod tests {
             response
         );
 
+        let request = ControlRequest::SecretBearerVerify {
+            secret: "bearer:test".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capabilities: vec!["cas.fetch".to_owned()],
+            nonce: "nonce".to_owned(),
+            response: "response".to_owned(),
+        };
+        assert_eq!(
+            decode_request(&encode_request(&request).expect("encode")).expect("decode"),
+            request
+        );
+
+        let response = ControlResponse::SecretBearerVerified {
+            secret: "bearer:test".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capabilities: vec!["cas.fetch".to_owned()],
+            verified: true,
+            reason: "ok".to_owned(),
+        };
+        assert_eq!(
+            decode_response(&encode_response(&response).expect("encode")).expect("decode"),
+            response
+        );
+
         let request = ControlRequest::CasFetch {
             node: "node:peer".to_owned(),
             hash: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef".into(),