Ruslan Nigmatullin 3661fcf49f app-server: add codex-device-key crate ...

## Why

Device-key storage and signing are local security-sensitive operations with platform-specific behavior. Keeping the core API in codex-device-key keeps app-server focused on routing and business logic instead of owning key-management details.

The crate also keeps the signing surface intentionally narrow: callers can create a bound key, fetch its public key, or sign one of the structured payloads accepted by the crate. It does not expose a generic arbitrary-byte signing API.

Key IDs cross into platform-specific labels, tags, and metadata paths, so the crate constrains externally supplied IDs to the same auditable namespace it creates: dk_ plus unpadded base64url for 32 bytes. Remote-control target paths are tied to each signed payload shape so connection proofs cannot be reused for enrollment endpoints, or vice versa.

## What changed

- Added the codex-device-key workspace crate.
- Added account/client-bound key creation with stable dk_ key IDs.
- Added strict key_id validation before public-key lookup or signing reaches a provider.
- Added public-key lookup and structured signing APIs.
- Split remote-control client endpoint allowlists by connection vs enrollment payload shape.
- Added validation for key bindings, accepted payload fields, token expiration, and payload/key binding mismatches.
- Added flow-oriented docs on the validation helpers that gate provider signing.
- Added protection policy and protection-class types without wiring a platform provider yet.
- Added an unsupported default provider so platforms without an implementation fail explicitly instead of silently falling back to software-backed keys.
- Updated Cargo and Bazel lock metadata for the new crate and non-platform-specific dependencies.

## Validation

- just fmt
- cargo test -p codex-device-key
- just fix -p codex-device-key
- git diff --check

2026-04-21 10:10:22 -07:00

1.3 MiB

Raw Permalink Blame History

View Raw