Public dry run dryrun-20b59dc46b72

Source commit: 20b59dc46b72103c2f8a516c692b5cc3d54fab19

Public tree identity: sha256:aaa5ac7b58b2a0d23c6b11e5f76324bf3839ca1f62653a83deb736932adcfbd9

crates/disasmer-core/src/wire.rs

@@ -0,0 +1,114 @@
+use serde_json::{json, Value};
+
+pub const COORDINATOR_PROTOCOL_VERSION: u64 = 1;
+pub const COORDINATOR_WIRE_REQUEST_TYPE: &str = "coordinator_request";
+
+pub fn coordinator_wire_request(request_id: impl Into<String>, payload: Value) -> Value {
+    let operation = coordinator_payload_operation(&payload);
+    let authentication = coordinator_authentication_metadata(&payload);
+    json!({
+        "type": COORDINATOR_WIRE_REQUEST_TYPE,
+        "protocol_version": COORDINATOR_PROTOCOL_VERSION,
+        "request_id": request_id.into(),
+        "operation": operation,
+        "authentication": authentication,
+        "payload": payload,
+    })
+}
+
+pub fn coordinator_payload_operation(payload: &Value) -> String {
+    payload
+        .get("type")
+        .and_then(Value::as_str)
+        .unwrap_or("unknown")
+        .to_owned()
+}
+
+pub fn coordinator_authentication_metadata(payload: &Value) -> Value {
+    let operation = coordinator_payload_operation(payload);
+    match operation.as_str() {
+        "authenticated" => json!({
+            "kind": "cli_session",
+            "session": true,
+            "request_operation": payload
+                .get("request")
+                .map(coordinator_payload_operation)
+                .unwrap_or_else(|| "unknown".to_owned()),
+        }),
+        "signed_node" => json!({
+            "kind": "node_signature",
+            "node": payload.get("node").and_then(Value::as_str),
+        }),
+        "node_heartbeat" if payload.get("node_signature").is_some() => json!({
+            "kind": "node_signature",
+            "node": payload.get("node").and_then(Value::as_str),
+        }),
+        "start_process" | "launch_task" if payload.get("agent_signature").is_some() => json!({
+            "kind": "agent_signature",
+            "agent": payload.get("actor_agent").and_then(Value::as_str),
+            "fingerprint": payload.get("agent_public_key_fingerprint").and_then(Value::as_str),
+        }),
+        "admin_status" | "suspend_tenant" if payload.get("admin_proof").is_some() => json!({
+            "kind": "admin_proof",
+            "actor": payload.get("actor_user").and_then(Value::as_str),
+            "nonce": payload.get("admin_nonce").and_then(Value::as_str),
+            "issued_at_epoch_seconds": payload.get("issued_at_epoch_seconds").and_then(Value::as_u64),
+        }),
+        "exchange_node_enrollment_grant" => json!({
+            "kind": "node_enrollment_grant",
+            "node": payload.get("node").and_then(Value::as_str),
+        }),
+        _ => json!({
+            "kind": "none",
+        }),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn coordinator_wire_request_wraps_payload_without_exposing_secret_metadata() {
+        let envelope = coordinator_wire_request(
+            "cli-1",
+            json!({
+                "type": "authenticated",
+                "session_secret": "secret-value",
+                "request": { "type": "list_projects" },
+            }),
+        );
+
+        assert_eq!(envelope["type"], COORDINATOR_WIRE_REQUEST_TYPE);
+        assert_eq!(envelope["protocol_version"], COORDINATOR_PROTOCOL_VERSION);
+        assert_eq!(envelope["request_id"], "cli-1");
+        assert_eq!(envelope["operation"], "authenticated");
+        assert_eq!(envelope["authentication"]["kind"], "cli_session");
+        assert_eq!(
+            envelope["authentication"]["request_operation"],
+            "list_projects"
+        );
+        assert_eq!(envelope["authentication"].get("session_secret"), None);
+        assert_eq!(envelope["payload"]["session_secret"], "secret-value");
+    }
+
+    #[test]
+    fn coordinator_wire_request_describes_signature_metadata() {
+        let envelope = coordinator_wire_request(
+            "node-1",
+            json!({
+                "type": "signed_node",
+                "node": "node-a",
+                "node_signature": {
+                    "nonce": "nonce",
+                    "issued_at_epoch_seconds": 1,
+                    "signature": "ed25519:sig"
+                },
+                "request": { "type": "poll_task_assignment", "node": "node-a" },
+            }),
+        );
+
+        assert_eq!(envelope["authentication"]["kind"], "node_signature");
+        assert_eq!(envelope["authentication"]["node"], "node-a");
+    }
+}