Struct LabelExtractor 

pub struct LabelExtractor {
    pub label: String,
    pub ca_id: String,
    pub require_cn_match: bool,
    pub require_san_match: bool,
    pub permitted_dns_names: Vec<String>,
    pub permitted_ip_addresses: Vec<String>,
    pub permitted_emails: Vec<String>,
    pub csr_attributes: Vec<String>,
    pub csr_template: Option<CsrTemplate>,
    pub max_validity_days: Option<u32>,
    pub disconnected: Option<bool>,
}

Resolved EST label configuration for the current request.

Analogous to Akamu’s CaId extractor — resolves the {label} path segment to the corresponding EstLabelConfig entry, falling back to the default label when no path segment is present.

Usage

async fn handler(label: LabelExtractor, ...) -> impl IntoResponse {
    let ca_id = label.ca_id();
    // ...
}

Fields

label: String

The resolved label name (empty string for the default label).

ca_id: String

The CA identifier to use for this label.

require_cn_match: bool

Whether CN matching is required for this label (FDP_ACF.1).

require_san_match: bool

Whether the authenticated identity must appear in the CSR SAN (FDP_ACF.1).

permitted_dns_names: Vec<String>

Name-authorization allowlist: permitted dNSName patterns (RFC 6125).

permitted_ip_addresses: Vec<String>

Name-authorization allowlist: permitted iPAddress SANs (textual form).

permitted_emails: Vec<String>

Name-authorization allowlist: permitted rfc822Name patterns.

csr_attributes: Vec<String>

Per-label CSR attribute OIDs (overrides global when non-empty).

csr_template: Option<CsrTemplate>

Per-label CSR template (RFC 9908); None means no template.

max_validity_days: Option<u32>

Per-label maximum validity (overrides CA default).

disconnected: Option<bool>

Per-label disconnected mode override.

Implementations

impl LabelExtractor

pub fn ca_id(&self) -> &str

The effective CA identifier for this label.

pub fn enroll_policy(&self) -> EnrollAuthzPolicy<'_>

Borrow this label’s enrollment-authorization policy (FDP_ACF.1).

Single source of truth for every enrollment entry point — the direct /simpleenroll path and the CMS-EST wrappers all build the policy this way, so identity binding and name authorization stay consistent across transports.

pub fn resolve( app: &AppState, label_name: Option<&str>, ) -> Result<Self, KipukaError>

Resolve a label name into its effective enrollment configuration.

This is the transport-agnostic core shared by the axum [FromRequestParts] extractor (HTTP/CMS-EST) and the CoAP bridge (crate::routes::coap). Centralising it here means the per-label FDP_ACF.1 policy — identity binding and the name allowlist — resolves identically no matter which transport carried the request, closing the gap where EST-coaps issued certificates without applying any label policy at all.

label_name is None/Some("") for the default (unlabeled) endpoint, which carries no authorization policy and issues from the default CA.

Errors

• KipukaError::NotFound when a non-empty label is not configured.
• KipukaError::Config when a configured label points at a CA that does not exist.

Trait Implementations

impl Clone for LabelExtractor

fn clone(&self) -> LabelExtractor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LabelExtractor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S> FromRequestParts<S> for LabelExtractor

where S: Send + Sync, Arc<AppState>: FromRef<S>,

type Rejection = Response<Body>

If the extractor fails it’ll use this “rejection” type. A rejection is a kind of error that can be converted into a response.

async fn from_request_parts( parts: &mut Parts, state: &S, ) -> Result<Self, Response>

Perform the extraction.