Struct WssClientAuthConfig 

pub struct WssClientAuthConfig {
    pub enabled: bool,
    pub ca_cert_path: String,
    pub pinned_certs: Vec<String>,
    pub crl_path: String,
}

Client certificate authentication (mTLS) for the remote WSS transport ([wss.client_auth]).

This mirrors GatewayClientAuthConfig; the two are distinct structs only because the Configurable derive binds the section prefix into the type. The verification logic itself is single-sourced in the zeroclaw-tls crate.

Unlike the gateway’s variant there is no require_client_cert knob: the remote WSS plane is always mutually authenticated (there is no server-only-TLS path), so a client certificate is unconditionally required.

Fields

enabled: bool

Use the bring-your-own CA below. When false (default) the daemon auto-generates its own CA. The WSS plane is always mutually authenticated either way; this does NOT toggle whether a client certificate is required.

ca_cert_path: String

Path to the PEM-encoded CA certificate used to verify client certificates.

pinned_certs: Vec<String>

Optional SHA-256 fingerprints for certificate pinning. When non-empty, only client certs matching one of these fingerprints are accepted.

crl_path: String

Optional path to a revoked-fingerprint list (one SHA-256 hex per line). A client cert whose fingerprint is listed is refused at the handshake (A5); the file is re-read when it changes. Empty (default) makes the daemon use its ledger-materialized list at <data_dir>/tls/revoked.

Implementations

impl WssClientAuthConfig

pub fn configurable_prefix() -> &'static str

Returns the #[prefix] value for this Configurable struct.

pub fn init_requires_explicit_config() -> bool

True when this struct has a required leaf field that a bare/ancestor-prefix init_defaults scaffold must not materialize (it would fill the field with its Rust Default, which prune_empty_leaves then strips on save, leaving a partial sub-table that fails strict reload). Explicitly targeting this section (or a descendant of it) still scaffolds regardless of this flag, so the section can be materialized for the operator to fill in.

pub fn secret_fields(&self) -> Vec<SecretFieldInfo>

Returns metadata about all #[secret] fields on this struct and nested children.

pub fn secret_field_terminals() -> Vec<&'static str>

pub fn encrypt_secrets(&mut self, store: &SecretStore) -> Result<()>

Encrypt all secret fields in place using the provided store.

pub fn decrypt_secrets(&mut self, store: &SecretStore) -> Result<()>

Decrypt all secret fields in place using the provided store.

pub fn set_secret(&mut self, name: &str, value: String) -> Result<()>

Set a secret field by its full dotted name, dispatching to nested children.

pub fn prop_fields(&self) -> Vec<PropFieldInfo>

Returns metadata about all property fields on this struct and nested children.

pub fn get_prop(&self, name: &str) -> Result<String>

Get a property value by its full dotted name, returning it as a display string.

pub fn set_prop(&mut self, name: &str, value_str: &str) -> Result<()>

Set a property value by its full dotted name, parsing from string.

pub fn prop_is_secret(name: &str) -> bool

Check if a property name refers to a secret field (static, no instance needed).

pub fn init_defaults(&mut self, prefix: Option<&str>) -> Vec<&'static str>

Instantiate None nested sections whose prefix matches. Returns the prefixes that were initialized.

pub fn map_key_sections() -> Vec<MapKeySection>

Enumerate every map-keyed (HashMap<String, T>) and list-shaped (Vec<T>) section discoverable from this Configurable’s tree. The dashboard / CLI consume this to surface “+ Add” affordances without hardcoding the section list.

pub fn nested_section_help(name: &str) -> Option<&'static str>

Help blurb for a #[nested] field on this struct, sourced from the field-level /// docstring. Returns None for unknown names so callers can fall through to a different lookup.

pub fn nested_section_group(name: &str) -> Option<&'static str>

pub fn get_map_keys(&self, section_path: &str) -> Option<Vec<String>>

Return the current alias keys at section_path, or None if the path doesn’t resolve to a map-keyed section in this tree.

pub fn nested_option_entries(&self) -> Vec<NestedOptionEntry>

pub fn create_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn delete_map_key( &mut self, section_path: &str, map_key: &str, ) -> Result<bool, String>

pub fn rename_map_key( &mut self, section_path: &str, map_key: &str, new_key: &str, ) -> Result<bool, String>

impl WssClientAuthConfig

pub fn external_ca_path(&self) -> Option<&str>

The operator-provided (bring-your-own) CA that verifies client certificates, when one is in effect: client auth enabled with a CA path. In that mode the daemon holds no CA signing key, so it verifies clients but cannot issue certificates and does not run the enrollment endpoint.

Trait Implementations

impl Clone for WssClientAuthConfig

fn clone(&self) -> WssClientAuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WssClientAuthConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for WssClientAuthConfig

fn default() -> WssClientAuthConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for WssClientAuthConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for WssClientAuthConfig

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl MaskSecrets for WssClientAuthConfig

fn mask_secrets(&mut self)

fn restore_secrets_from(&mut self, current: &Self)

impl Serialize for WssClientAuthConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.