(&self)
| 147 | |
| 148 | impl RpcHandler { |
| 149 | async fn ensure_self_allowed(&self) -> Result<()> { |
| 150 | if !self.state.config.enforce_self_authorization { |
| 151 | return Ok(()); |
| 152 | } |
| 153 | let boot_info = self |
| 154 | .state |
| 155 | .self_boot_info |
| 156 | .get_or_try_init(|| local_kms_boot_info(self.state.config.pccs_url.as_deref())) |
| 157 | .await |
| 158 | .context("Failed to load cached self boot info")?; |
| 159 | let response = self |
| 160 | .state |
| 161 | .config |
| 162 | .auth_api |
| 163 | .is_app_allowed(boot_info, true) |
| 164 | .await |
| 165 | .context("Failed to call self KMS auth check")?; |
| 166 | if !response.is_allowed { |
| 167 | bail!("KMS is not allowed: {}", response.reason); |
| 168 | } |
| 169 | Ok(()) |
| 170 | } |
| 171 | |
| 172 | fn ensure_attested(&self) -> Result<&VerifiedAttestation> { |
| 173 | let Some(attestation) = &self.attestation else { |
no test coverage detected