36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
# ADR 0004: Device Auth Persistence Port Ownership
|
|
|
|
## Status
|
|
|
|
Accepted
|
|
|
|
## Context
|
|
|
|
Device authentication persists long-lived key material and runtime JWT/backoff
|
|
state. The bytes are meaningful only to the authentication policy, but the
|
|
storage location also needs legacy migration names and must stay off the
|
|
generic platform key/value API at upper layers.
|
|
|
|
## Decision
|
|
|
|
- `platform` owns only opaque blob key/value primitives and NVS mechanics.
|
|
- `domain` owns the narrow auth persistence port: the public auth record slot
|
|
enum, mapping to storage namespaces/keys, legacy migration target names, and
|
|
atomic load/save adapter.
|
|
- `control_plane` owns the serialized auth key/state schemas, challenge/response
|
|
policy, JWT refresh policy, retry/backoff state transitions, and factory
|
|
rotation behavior.
|
|
- Upper layers must not call generic storage adapters for auth records. They
|
|
must use `domain_runtime_auth_store_load_record()` and
|
|
`domain_runtime_auth_store_save_record()`.
|
|
|
|
## Consequences
|
|
|
|
- Auth persistence has one facade declaration without exposing platform storage
|
|
types to `control_plane`.
|
|
- Changing the serialized record layout remains a `control_plane` migration
|
|
concern.
|
|
- Changing NVS namespace/key migration names remains a `domain` adapter concern.
|
|
- A future secure-element or encrypted-storage backend can replace the platform
|
|
blob primitive without changing auth policy contracts.
|