Implement identity trust module

2026-08-01 20:57:27 +02:00
parent 765fcd5a2d
commit 0ffc8b6b0f
20 changed files with 2058 additions and 5 deletions
@@ -0,0 +1,133 @@
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Any, Literal
+
+from pydantic import BaseModel, Field
+
+
+class DeviceKeyRegisterPayload(BaseModel):
+    identity_id: str = Field(min_length=1, max_length=255)
+    account_id: str = Field(min_length=1, max_length=255)
+    device_id: str = Field(min_length=1, max_length=255)
+    key_id: str = Field(min_length=1, max_length=255)
+    algorithm: str = Field(min_length=1, max_length=120)
+    public_jwk: dict[str, Any]
+    purpose: Literal["encryption", "signing", "encryption_and_signing"] = "encryption"
+    assurance_level: str = Field(default="software", min_length=1, max_length=80)
+    attestation_ref: str | None = Field(default=None, max_length=1000)
+    expires_at: datetime | None = None
+    idempotency_key: str = Field(min_length=1, max_length=255)
+
+
+class DeviceKeyRevokePayload(BaseModel):
+    expected_epoch: int = Field(ge=1)
+    reason: str = Field(min_length=1, max_length=4000)
+
+
+class DeviceKeyResponse(BaseModel):
+    tenant_id: str
+    identity_id: str
+    account_id: str
+    device_id: str
+    key_id: str
+    algorithm: str
+    public_jwk: dict[str, Any]
+    purpose: str
+    assurance_level: str
+    status: str
+    epoch: int
+    registered_at: datetime
+    attestation_ref: str | None = None
+    expires_at: datetime | None = None
+    revoked_at: datetime | None = None
+    revocation_reason: str | None = None
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
+class DeviceKeyListResponse(BaseModel):
+    keys: list[DeviceKeyResponse]
+
+
+class EpochRotatePayload(BaseModel):
+    subject_kind: Literal[
+        "identity", "account", "function", "postbox", "external_recipient"
+    ]
+    subject_id: str = Field(min_length=1, max_length=255)
+    reason: str = Field(min_length=1, max_length=4000)
+    access_decision_ref: str = Field(min_length=1, max_length=1000)
+    idempotency_key: str = Field(min_length=1, max_length=255)
+    history_policy: str = Field(default="all_retained", min_length=1, max_length=80)
+    previous_epoch: int | None = Field(default=None, ge=1)
+
+
+class EpochResponse(BaseModel):
+    tenant_id: str
+    subject_kind: str
+    subject_id: str
+    epoch: int
+    state: str
+    history_policy: str
+    effective_at: datetime
+    previous_epoch: int | None = None
+    reason: str | None = None
+    access_decision_ref: str | None = None
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
+class KeyAccessPayload(BaseModel):
+    account_id: str = Field(min_length=1, max_length=255)
+    device_key_id: str = Field(min_length=1, max_length=255)
+    subject_kind: Literal[
+        "identity", "account", "function", "postbox", "external_recipient"
+    ]
+    subject_id: str = Field(min_length=1, max_length=255)
+    key_epoch: int = Field(ge=1)
+    access_decision_ref: str = Field(min_length=1, max_length=1000)
+    purpose: str = Field(min_length=1, max_length=255)
+    requested_at: datetime
+    function_assignment_id: str | None = Field(default=None, max_length=255)
+    delegation_id: str | None = Field(default=None, max_length=255)
+    resource_ref: str | None = Field(default=None, max_length=1000)
+
+
+class KeyAccessResponse(BaseModel):
+    allowed: bool
+    decision_ref: str
+    reason: str
+    device_key: DeviceKeyResponse | None = None
+    epoch: EpochResponse | None = None
+    audit_event_ref: str | None = None
+    requirements: list[str] = Field(default_factory=list)
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
+class AssuranceEvidencePayload(BaseModel):
+    account_id: str = Field(min_length=1, max_length=255)
+    evidence_ref: str = Field(min_length=1, max_length=1000)
+    assurance_level: str = Field(min_length=1, max_length=80)
+    provider_id: str = Field(min_length=1, max_length=120)
+    verified_at: datetime
+    expires_at: datetime
+    device_key_id: str | None = Field(default=None, max_length=255)
+    provenance: dict[str, Any] = Field(default_factory=dict)
+
+
+class AssuranceCheckPayload(BaseModel):
+    account_id: str = Field(min_length=1, max_length=255)
+    purpose: str = Field(min_length=1, max_length=255)
+    minimum_level: str = Field(min_length=1, max_length=80)
+    evidence_ref: str = Field(min_length=1, max_length=1000)
+    evaluated_at: datetime
+    maximum_age_seconds: int = Field(default=300, ge=1, le=86400)
+    device_key_id: str | None = Field(default=None, max_length=255)
+
+
+class AssuranceResponse(BaseModel):
+    allowed: bool
+    reason: str
+    assurance_level: str | None = None
+    evidence_ref: str | None = None
+    verified_at: datetime | None = None
+    expires_at: datetime | None = None
+    provenance: dict[str, Any] = Field(default_factory=dict)