Class: Legion::Extensions::Llm::Inventory::PublisherToken

Inherits:
Object
  • Object
show all
Defined in:
lib/legion/extensions/llm/inventory/probe_token.rb

Overview

An opaque fenced publisher claim token. The raw secret is never serialized, logged, included in a record/snapshot/exception, returned separately, or compared for order. publisher_id and publisher_token_id are safe UUID correlation values — the id law forbids digest-encoded ids on any wire/DB/log surface, so the token id is a UUID like every other lifecycle handle, NOT a derivation of the secret. Fencing is the constant-time secret comparison; the public ids correlate, they do not authenticate. See phase-1-lex-llm-additive.md section 11.1.

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(instance_key:, secret:, publisher_id:, publisher_token_id:) ⇒ PublisherToken

Returns a new instance of PublisherToken.

Raises:



33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'lib/legion/extensions/llm/inventory/probe_token.rb', line 33

def initialize(instance_key:, secret:, publisher_id:, publisher_token_id:)
  raise Errors::ValidationError, 'instance_key must be an InstanceKey' unless instance_key.is_a?(Identity::InstanceKey)
  raise Errors::ValidationError, 'secret must be a nonempty String' unless nonempty_string?(secret)
  raise Errors::ValidationError, 'publisher_id must be a pub:v1: String' unless publisher_id.to_s.start_with?('pub:v1:')
  raise Errors::ValidationError, 'publisher_token_id must be a ptok:v1: String' unless publisher_token_id.to_s.start_with?('ptok:v1:')

  @instance_key = instance_key
  @secret = secret.b.dup.freeze
  @publisher_id = publisher_id.dup.freeze
  @publisher_token_id = publisher_token_id.dup.freeze
  freeze
end

Instance Attribute Details

#instance_key ⇒ Object (readonly)

Returns the value of attribute instance_key.



21
22
23
 
# File 'lib/legion/extensions/llm/inventory/probe_token.rb', line 21

def instance_key
  @instance_key
end

#publisher_id ⇒ Object (readonly)

Returns the value of attribute publisher_id.



21
22
23
 
# File 'lib/legion/extensions/llm/inventory/probe_token.rb', line 21

def publisher_id
  @publisher_id
end

#publisher_token_id ⇒ Object (readonly)

Returns the value of attribute publisher_token_id.



21
22
23
 
# File 'lib/legion/extensions/llm/inventory/probe_token.rb', line 21

def publisher_token_id
  @publisher_token_id
end

Class Method Details

.issue(instance_key:) ⇒ Object

Factory used by the registry: builds a fresh secret and mints the public correlation IDs.



25
26
27
28
29
30
31
 
# File 'lib/legion/extensions/llm/inventory/probe_token.rb', line 25

def self.issue(instance_key:)
  secret = ::SecureRandom.hex(32)
  new(
    instance_key: instance_key, secret: secret,
    publisher_id: "pub:v1:#{::SecureRandom.uuid}", publisher_token_id: "ptok:v1:#{::SecureRandom.uuid}"
  )
end

Instance Method Details

#authenticates?(other) ⇒ Boolean

Fenced validation: same InstanceKey, same public token ID, and a constant-time equal-length secret comparison using a local XOR accumulator (no ActiveSupport).

Returns:

  • (Boolean) 


49
50
51
52
53
54
 
# File 'lib/legion/extensions/llm/inventory/probe_token.rb', line 49

def authenticates?(other)
  other.is_a?(PublisherToken) &&
    instance_key == other.instance_key &&
    publisher_token_id == other.publisher_token_id &&
    secrets_match?(other)
end

#inspect ⇒ Object Also known as: to_s 



56
57
58
59
 
# File 'lib/legion/extensions/llm/inventory/probe_token.rb', line 56

def inspect
  "#<#{self.class.name} instance_key=#{@instance_key.inspect} " \
    "publisher_id=#{@publisher_id} publisher_token_id=#{@publisher_token_id} secret=[REDACTED]>"
end