feat: add policy to relevant key-based functions

witx/proposal_asymmetric_common.witx

@@ -19,9 +19,11 @@
     ;;; Example usage:
     ;;;
     ;;; ```rust
-    ;;; let kp_handle = ctx.keypair_generate(AlgorithmType::Signatures, "RSA_PKCS1_2048_SHA256", None)?;
+    ;;; let policy = ctx.get_policy("Encryption_only_policy)?;"
+    ;;; let kp_handle = ctx.keypair_generate(policy, AlgorithmType::Signatures, "RSA_PKCS1_2048_SHA256", None)?;
     ;;; ```
     (@interface func (export "keypair_generate")
+        (param $policy $policy)
         (param $algorithm_type $algorithm_type)
         (param $algorithm string)
         (param $options $opt_options)
@@ -39,9 +41,11 @@
     ;;; Example usage:
     ;;;
     ;;; ```rust
-    ;;; let kp_handle = ctx.keypair_import(AlgorithmType::Signatures, "RSA_PKCS1_2048_SHA256", KeypairEncoding::PKCS8)?;
+    ;;; let policy = ctx.get_policy("Encryption_only_policy)?;"
+    ;;; let kp_handle = ctx.keypair_import(policy, AlgorithmType::Signatures, "RSA_PKCS1_2048_SHA256", KeypairEncoding::PKCS8)?;
     ;;; ```
     (@interface func (export "keypair_import")
+        (param $policy $policy)
         (param $algorithm_type $algorithm_type)
         (param $algorithm string)
         (param $encoded (@witx const_pointer u8))
@@ -193,9 +197,11 @@
     ;;; Example usage:
     ;;;
     ;;; ```rust
+    ;;; let policy = ctx.get_policy("Encryption_only_policy)?;"
     ;;; let pk_handle = ctx.publickey_import(AlgorithmType::Signatures, encoded, PublicKeyEncoding::Sec)?;
     ;;; ```
     (@interface func (export "publickey_import")
+        (param $policy $policy)
         (param $algorithm_type $algorithm_type)
         (param $algorithm string)
         (param $encoded (@witx const_pointer u8))
@@ -248,9 +254,11 @@
     ;;; Example usage:
     ;;;
     ;;; ```rust
-    ;;; let pk_handle = ctx.secretkey_import(AlgorithmType::KX, encoded, SecretKeyEncoding::Raw)?;
+    ;;; let policy = ctx.get_policy("Encryption_only_policy)?;"
+    ;;; let pk_handle = ctx.secretkey_import(policy, AlgorithmType::KX, encoded, SecretKeyEncoding::Raw)?;
     ;;; ```
     (@interface func (export "secretkey_import")
+        (param $policy $policy)
         (param $algorithm_type $algorithm_type)
         (param $algorithm string)
         (param $encoded (@witx const_pointer u8))

witx/proposal_common.witx

@@ -144,6 +144,12 @@
 
         ;;; A managed key or secret expired and cannot be used any more.
         $expired
+
+        ;;; Invalid policy handle
+        $policy_invalid
+
+        ;;; Not allowed by policy
+        $policy_unallowed
     )
 )
 
@@ -253,6 +259,11 @@
 ;;; An `array_output` handle is automatically closed after its full content has been consumed.
 (typename $array_output (handle))
 
+;;; Key policy document
+;;;
+;;; This type is used to represent a policy to control how a keypair may be used.
+(typename $policy (handle))
+
 ;;; A set of options.
 ;;;
 ;;; This type is used to set non-default parameters.
@@ -392,6 +403,14 @@
         (result $error (expected (error $crypto_errno)))
     )
 
+    ;;; Get a policy handle
+    ;;;
+    ;;; This function returns a handle for a policy, or an error if the policy does not exist.
+    (@interface func (export "get_policy")
+        (param $name string)
+        (result $error (expected $policy (error $crypto_errno)))
+    )
+
     ;;; Return the length of an `array_output` object.
     ;;;
     ;;; This allows a guest to allocate a buffer of the correct size in order to copy the output of a function returning this object type.