54 lines
2.0 KiB
Go
54 lines
2.0 KiB
Go
|
package contract
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"strings"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
// CustomerAccessProof is a host-verified, short-lived customer request proof.
|
||
|
|
// It intentionally contains no password, bearer token, card number, or device
|
||
|
|
// number. The opaque SessionID can only be issued and validated by the host.
|
||
|
|
type CustomerAccessProof struct {
|
||
|
|
SessionID string
|
||
|
|
TargetType string
|
||
|
|
TargetID int64
|
||
|
|
ConversationID int64
|
||
|
|
MessageID int64
|
||
|
|
RequestID string
|
||
|
|
ExpiresAt time.Time
|
||
|
|
}
|
||
|
|
|
||
|
|
type customerAccessProofContextKey struct{}
|
||
|
|
|
||
|
|
// WithCustomerAccessProof attaches a copy of a host-verified proof to the
|
||
|
|
// current request. Agent Desk propagates only these claims into async runs.
|
||
|
|
func WithCustomerAccessProof(ctx context.Context, proof CustomerAccessProof) context.Context {
|
||
|
|
return context.WithValue(ctx, customerAccessProofContextKey{}, proof)
|
||
|
|
}
|
||
|
|
|
||
|
|
// CustomerAccessProofFromContext returns only a structurally valid, live
|
||
|
|
// proof. The host must still verify SessionID against its server-side store.
|
||
|
|
func CustomerAccessProofFromContext(ctx context.Context) (CustomerAccessProof, bool) {
|
||
|
|
proof, ok := ctx.Value(customerAccessProofContextKey{}).(CustomerAccessProof)
|
||
|
|
if !ok || strings.TrimSpace(proof.SessionID) == "" || proof.TargetID <= 0 ||
|
||
|
|
(strings.TrimSpace(proof.TargetType) != "card" && strings.TrimSpace(proof.TargetType) != "device") ||
|
||
|
|
proof.ExpiresAt.IsZero() || !proof.ExpiresAt.After(time.Now()) {
|
||
|
|
return CustomerAccessProof{}, false
|
||
|
|
}
|
||
|
|
return proof, true
|
||
|
|
}
|
||
|
|
|
||
|
|
// BindCustomerAccessProofToMessage binds the current request proof to the
|
||
|
|
// exact persisted customer message that triggered an async Agent run.
|
||
|
|
func BindCustomerAccessProofToMessage(ctx context.Context, conversationID, messageID int64, requestID string) context.Context {
|
||
|
|
proof, ok := CustomerAccessProofFromContext(ctx)
|
||
|
|
if !ok {
|
||
|
|
return ctx
|
||
|
|
}
|
||
|
|
proof.ConversationID = conversationID
|
||
|
|
proof.MessageID = messageID
|
||
|
|
proof.RequestID = strings.TrimSpace(requestID)
|
||
|
|
return WithCustomerAccessProof(ctx, proof)
|
||
|
|
}
|