gleamunison/trust

Trust lifecycle for signers: rotation windows, expiry, revocation.

Evidence signatures (HMAC) live in evidence.gleam; this module owns the policy decision of WHETHER a signer is currently trusted. Verification composes the two: a record is admitted only when the signature matches a trusted signer AND that signer’s key state admits the record timestamp.

Types

KeyState

</>

pub type KeyState {
  Active(since: Int, until: Int)
  Revoked
}

Constructors

```
Active(since: Int, until: Int)
```
Usable from since until until (exclusive). A rotation overlap is two Active entries: old with until = T, new with since = T - overlap.
```
Revoked
```
Permanently untrusted, regardless of timestamps.

TrustPolicy

</>

pub type TrustPolicy {
  TrustPolicy(keys: List(TrustedKey))
}

Constructors

```
TrustPolicy(keys: List(TrustedKey))
```

TrustRefusal

</>

pub type TrustRefusal {
  UnknownSigner(id: String)
  KeyRevoked(id: String)
  KeyNotYetValid(id: String, since: Int)
  KeyExpired(id: String, until: Int)
  SignatureMismatch(id: String)
  UnsignedRecord
}

Constructors

```
UnknownSigner(id: String)
```
```
KeyRevoked(id: String)
```
```
KeyNotYetValid(id: String, since: Int)
```
```
KeyExpired(id: String, until: Int)
```
```
SignatureMismatch(id: String)
```
```
UnsignedRecord
```

TrustedKey

</>

pub type TrustedKey {
  TrustedKey(signer: evidence.Signer, state: KeyState)
}

Constructors

TrustedKey(signer: evidence.Signer, state: KeyState)

Values

active

</>

pub fn active(
  signer: evidence.Signer,
  since: Int,
  until: Int,
) -> TrustedKey

admit

</>

pub fn admit(
  policy: TrustPolicy,
  record: evidence.Evidence,
) -> Result(evidence.Evidence, TrustRefusal)

Full admission: key state at the record’s timestamp AND a signature that matches that signer’s secret. Unsigned records are always refused here; local fixtures that need unsigned data use evidence.AllowUnsigned, not a trust policy.

key_admits

</>

pub fn key_admits(
  policy: TrustPolicy,
  signer_id: String,
  ts: Int,
) -> Result(TrustedKey, TrustRefusal)

Pure key-state decision: does this signer id admit a record at ts?

policy

</>

pub fn policy(keys: List(TrustedKey)) -> TrustPolicy

refusal_name

</>

pub fn refusal_name(refusal: TrustRefusal) -> String

revoked

</>

pub fn revoked(signer: evidence.Signer) -> TrustedKey