Class ChallengeRequest

src/orgkernel/schemas/agent_identity.py:345–384

Request a cryptographic challenge for dynamic verification. The verifier sends a random challenge; the agent must sign it with its private key to prove possession.

class ChallengeRequest(BaseModel):
    """
    Request a cryptographic challenge for dynamic verification.

    The verifier sends a random challenge; the agent must sign it with its
    private key to prove possession.
    """
    agent_id: str = Field(min_length=10, max_length=32)
    challenge_id: str = Field(
        default_factory=lambda: "chal_" + uuid4().hex[:12],
        description="Unique challenge identifier.",
    )
    nonce: str = Field(
        min_length=16, max_length=64,
        description="Random nonce generated by the verifier.",
    )
    issued_by: str = Field(
        min_length=1, max_length=64,
        description="Identifier of the requesting system.",
    )
    created_at: datetime = Field(default_factory=_now_utc)
    expires_at: datetime = Field(
        description="UTC expiry timestamp for this challenge.",
    )

    @field_validator("nonce")
    @classmethod
    def _validate_nonce(cls, v: str) -> str:
        if not _NONCE_RE.match(v):
            raise ValueError(
                "nonce must be 16-64 chars of Base64url-safe characters."
            )
        return v

    @field_validator("expires_at")
    @classmethod
    def _validate_expiry(cls, v: datetime) -> datetime:
        if v <= _now_utc():
            raise ValueError("expires_at must be in the future.")
        return v


class ChallengeResponse(BaseModel):