Struct CaState 

pub struct CaState { /* private fields */ }

The stateless CA processor.

Holds in-flight request state and the signing identity. All methods take &self and are safe to call from concurrent tasks.

Implementations

impl CaState

pub fn new(config: CaConfig, manager: Arc<SecurityManager>) -> Self

pub fn cleanup_expired(&self, ttl_secs: u64)

Remove pending requests older than ttl_secs.

Called lazily from [handle_new] to amortize cleanup cost. Per NDNCERT 0.3, the NEW→CHALLENGE window is 60 seconds.

pub fn is_revoked(&self, cert_name: &str) -> bool

Check whether a certificate name has been revoked.

pub fn handle_info(&self) -> Vec<u8>

Handle a CA INFO request — return the CA’s profile as TLV.

pub fn handle_probe(&self, requested_name: &str) -> Vec<u8>

Handle a PROBE request — check namespace policy without creating state.

Route: /<ca-prefix>/CA/PROBE; requested name in ApplicationParameters. Returns TLV-encoded ProbeResponseTlv.

pub async fn handle_new(&self, body: &[u8]) -> Result<Vec<u8>, CertError>

Handle a NEW request — validate, perform ECDH, store state, return challenges.

Body: TLV-encoded NewRequestTlv (ECDH pub key + cert request bytes). Returns: TLV-encoded NewResponseTlv (CA ECDH pub key + salt + request_id + challenges).

pub async fn handle_challenge( &self, request_id: &str, body: &[u8], ) -> Result<Vec<u8>, CertError>

Handle a CHALLENGE request — decrypt parameters, verify, issue or deny.

Body: TLV-encoded [ChallengeRequestTlv] (encrypted challenge parameters). Returns: TLV-encoded ChallengeResponseTlv.

pub async fn handle_revoke(&self, body: &[u8]) -> Vec<u8>

Handle a REVOKE request.

Route: /<ca-prefix>/CA/REVOKE; body is TLV-encoded RevokeRequestTlv. Returns TLV-encoded RevokeResponseTlv.