Class AgentIdentityService

src/orgkernel/services/agent_identity_service.py:169–775

Service for AgentIdentity full PKI lifecycle management. PKI Flow: 1. submit_csr() - Agent submits CSR (public key + metadata) 2. issue_from_csr() - Org CA validates + signs -> AgentCertificate + identity 3. verify() - Static verification (s

class AgentIdentityService:
    """
    Service for AgentIdentity full PKI lifecycle management.

    PKI Flow:
        1. submit_csr()        - Agent submits CSR (public key + metadata)
        2. issue_from_csr()   - Org CA validates + signs -> AgentCertificate + identity
        3. verify()           - Static verification (status + expiry)
        4. request_challenge() - Verifier requests a challenge
        5. respond_challenge()  - Agent signs nonce (proves key possession)
        6. verify_challenge()   - Verifier validates signature
        7. revoke()           - Org authority revokes identity
    """

    def __init__(self, db: AsyncSession) -> None:
        self._db = db

    # ── Step 1: CSR Submission ──────────────────────────────────────────────

    async def submit_csr(self, csr: AgentIdentityCSR) -> AgentIdentityCSR:
        """
        Validate and store a CSR for later signing.

        Step 1 of the PKI lifecycle: Agent submits CSR with public key + metadata.
        The CSR is validated (duplicate check, key format) and queued for signing.
        The private key is NEVER transmitted — only the public key.

        Args:
            csr: CSR from the agent.

        Returns:
            The validated CSR with assigned csr_id.

        Raises:
            ValueError: If agent_name already exists in org.
        """
        existing = await self._db.execute(
            select(AgentIdentityModel).where(
                AgentIdentityModel.agent_name == csr.agent_name,
                AgentIdentityModel.org_id == csr.org_id,
            )
        )
        if existing.scalars().first() is not None:
            raise ValueError(
                f"AgentIdentity already exists for agent_name={csr.agent_name} in org={csr.org_id}"
            )
        return csr

    # ── Step 2: Issue from CSR (CA Signing) ────────────────────────────────

    async def issue_from_csr(self, csr: AgentIdentityCSR) -> AgentIdentityIssueResult:
        """
        Issue an AgentIdentity from a validated CSR — Org CA signing.

        Step 2-3 of the PKI lifecycle:
            2. Org CA validates the CSR request
            3. Signs and issues AgentCertificate