Module biometric 

The biometric proxy’s server half: each device’s enrolment, each purpose’s opaque blob, and revocation.

What the core stores it cannot read. A blob is wrapped by a client’s platform authenticator; this module keeps the bytes a client sent and hands the same bytes back on a release, and nothing here decodes one. The core still holds the vault’s unlocked keys in memory while the vault is open, exactly as it did before this feature - the blob store does not make it hands-off, and the design says so plainly.

A purpose is a registration, not a code path. A blob is keyed by the purpose string it arrived with and is otherwise opaque, so a second consumer is a new string plus its own blob shape in a client, and nothing in this module changes. a_second_consumer_needs_only_a_purpose is the guard on that.

Re-exports

use std::time::SystemTime; 🔒

use uuid::Uuid; 🔒

use forge_primitives::biometric::BiometricBlob; 🔒

use forge_primitives::biometric::BiometricEnrolment; 🔒

use forge_primitives::biometric::BiometricPurpose; 🔒

use crate::protocol::SessionUpdate; 🔒

use crate::workspace::Workspace; 🔒

Structs

Enrolment 🔒

One device’s enrolment as the store holds it: the facts a view draws plus each purpose’s wrapped blob.

StoredPurpose 🔒

One purpose’s stored half: the wrapped blob and its stamps. The bytes are opaque; nothing in the core decodes them.

Constants

MAX_BLOB_BYTES 🔒

The largest wrapped blob a client may enrol. The material is a refresh token and a user key, a few hundred bytes; the cap exists because the write is a client command and nothing else bounds it.

MAX_ENCODED_BYTES 🔒

The most base64 a wrapped blob may be before its decode is refused: the byte cap in base64, rounded up for the final group’s padding.

Functions

validated_blob 🔒

The bytes a wrapped blob names, refused before the decode can allocate past the cap.