Skip to main content

Variable: CommandEnvelopeClaims

const CommandEnvelopeClaims: TObject<{ bodyDigest: TString; correlationId: TString; exp: TInteger; instanceId: TString; messageId: TString; tenant: TString; verb: TString; }>

Defined in: packages/contracts/src/commands.ts:285

The claims of a command envelope: a compact JWS that proves which deployable sent one command, to which agent, for which tenant and with which body. Every claim is checked by the agent against the message it arrived with, and an envelope is useless on any other message:

  • instanceId is the instance the command is addressed to, and must equal the instance token of the subject it arrived on;
  • tenant is the subject id of the organisation whose profile the command works in. The agent opens that profile and no other;
  • verb is the command, <aggregate>.<verb> as the subject spells it, and must be one the kid's holder is listed against in the permission table;
  • bodyDigest is the SHA-256 of the body bytes as sent, so a body swapped under a valid envelope is refused;
  • correlationId ties the command to the request that caused it, and travels on into the agent's logs so a trace does not stop at the broker;
  • messageId is the command's own id, and the agent's idempotency key: a retry carries the same one and gets the first run's answer;
  • exp is the call's deadline, in seconds since the epoch. The agent drops a command past it and the sender never waits longer.

It is not a bearer credential: it names one message and dies with it.

The version of a command is in the subject and not in a claim. While every command is v1 that binds nothing more; the first v2 of a verb must add the version here, or an envelope signed for one version would be accepted on the other.