OperationAuthorizer

Decides whether a signed authorization actually authorizes this call, right now, once. A valid signature answers only *who*. Three more things have to hold before it authorizes anything, and each is a separate way of being wrong: 1. **It names this call.** The payload carries the operation, its arguments and the host. The caller states what it is about to run; if the signed bytes describe something else, the signature is someone's authorization for a different act. 2. **It is fresh.** A signature is valid forever — that is what signatures are — so without a window, one captured today authorizes the same operation next year. 3. **It is unused.** Freshness alone still leaves the window: the same bytes work as many times as they are presented inside it. The nonce is spent on first use. Skipping any one of them yields something that looks like authorization and is not, which is the expensive kind: it passes review because a signature was checked.

public function __construct(Milpa\ToolRuntime\Identity\SignatureVerifier $verifier, Milpa\ToolRuntime\Identity\NonceLedger $nonces, int $freshnessWindowSeconds = 120):

Parameters

public function authorize(string $operation, array $arguments, string $host, string $signedPayload, string $signature, int $now): Milpa\ToolRuntime\Identity\AuthorizationVerdict

Grants only when all four hold: valid signature, this call, fresh, unused. The order is deliberate — the nonce is spent last, because it is the only step with a side effect and a call refused for any other reason must leave the authorization usable.

Parameters