Add protected peer auth check

crates/geth-control/src/lib.rs

@@ -31,6 +31,11 @@ pub enum ControlRequest {
     PeerPing {
         node: String,
     },
+    PeerAuthCheck {
+        node: String,
+        resource: String,
+        capability: String,
+    },
     ResourceList,
     ResourceCreate {
         kind: String,
@@ -238,6 +243,17 @@ pub enum ControlResponse {
         alpn: String,
         note: String,
     },
+    PeerAuthChecked {
+        peer_node_id: String,
+        peer_agent_id: String,
+        endpoint_id: String,
+        resource: String,
+        capability: String,
+        allowed: bool,
+        reason: String,
+        evaluated_ops: usize,
+        note: String,
+    },
     ResourceList {
         resources: Vec<ResourceDescriptor>,
     },
@@ -441,7 +457,16 @@ pub struct CasBlob {
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[serde(tag = "type", rename_all = "kebab-case")]
 pub enum PeerControlRequest {
-    Ping { peer_card: PeerCard, nonce: String },
+    Ping {
+        peer_card: PeerCard,
+        nonce: String,
+    },
+    AuthCheck {
+        peer_card: PeerCard,
+        resource: String,
+        capability: String,
+        nonce: String,
+    },
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -456,6 +481,19 @@ pub enum PeerControlResponse {
         nonce: String,
         note: String,
     },
+    AuthChecked {
+        node_id: String,
+        agent_id: String,
+        endpoint_id: String,
+        remote_endpoint_id: String,
+        resource: String,
+        capability: String,
+        allowed: bool,
+        reason: String,
+        evaluated_ops: usize,
+        nonce: String,
+        note: String,
+    },
     Error {
         message: String,
     },
@@ -619,6 +657,16 @@ mod tests {
             request
         );
 
+        let request = ControlRequest::PeerAuthCheck {
+            node: "node:peer".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capability: "cas.fetch".to_owned(),
+        };
+        assert_eq!(
+            decode_request(&encode_request(&request).expect("encode")).expect("decode"),
+            request
+        );
+
         let response = PeerControlResponse::Pong {
             node_id: "node:peer".to_owned(),
             agent_id: "agent:peer".to_owned(),
@@ -633,5 +681,24 @@ mod tests {
                 .expect("decode"),
             response
         );
+
+        let response = PeerControlResponse::AuthChecked {
+            node_id: "node:peer".to_owned(),
+            agent_id: "agent:peer".to_owned(),
+            endpoint_id: "endpoint:peer".to_owned(),
+            remote_endpoint_id: "endpoint:caller".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capability: "cas.fetch".to_owned(),
+            allowed: false,
+            reason: "no grant".to_owned(),
+            evaluated_ops: 0,
+            nonce: "nonce".to_owned(),
+            note: "protected".to_owned(),
+        };
+        assert_eq!(
+            decode_peer_response(&encode_peer_response(&response).expect("encode"))
+                .expect("decode"),
+            response
+        );
     }
 }