/ 
Langertha-Raider-0.504
/ Langertha::Raider::Provider::Binding

NAME

Langertha::Raider::Provider::Binding - Internal stored binding of a provider alias: what is pinned, and whether a fetched manifest still matches

VERSION

version 0.504

SYNOPSIS

# Internal to Langertha-Raider -- no API promise.
my $class = 'Langertha::Raider::Provider::Binding';
my $entry = $class->entry($manifest, $origin,
  allow_internal => 0, credential_env => 'EXAMPLE_API_KEY');
# { origin => 'https://provider.example', issuer => 'https://provider.example',
#   auth => [ 'api_key' ], credential_env => 'EXAMPLE_API_KEY',
#   allow_internal => 0, pinned_at => '2026-10-15T09:30:00Z',
#   fingerprint => '3f2a...' }

my $why = $class->verify($entry, $fetched_manifest, $fetched_origin);   # undef: still the same

DESCRIPTION

Internal module. Its interface may change without notice.

The entry raider provider add ALIAS HOST stores under providers: in ~/.raider/config.yml (ADR 0011, written through "update_home" in Langertha::Raider::Config) and raider --provider ALIAS checks a freshly fetched manifest against. Pure logic: nothing is fetched, asked or stored here.

origin, issuer, auth -- what the user accepted: the origin the manifest was fetched from, the issuer it claims, and the sorted auth types its endpoints ask for. No TLS pin: a certificate rotation is no new trust decision.
credential_env -- the name of the environment variable the credential is read from at run time. The secret itself is never written to a file; the name is shown before the user accepts, because that variable's value is what goes to the provider. It is part of the pin: pointing an alias at another variable (by hand, say) would send another secret to the pinned origin, so it needs the same renewed acceptance (raider provider add) as a changed origin, and raider --provider ALIAS stops until then.
pinned_at -- when the user accepted, UTC, for display only.
fingerprint -- a field beyond origin, issuer and auth, the "fingerprint" in Langertha::Raider::Provider::Change of the accepted manifest (origin, issuer, provider id, every endpoint's origin, dialect and auth type) together with allow_internal and credential_env. The precise record that "verify" compares: it also catches an endpoint that moved, which origin, issuer and auth alone would not show. An entry without one never matches.

A manifest change that Langertha::Raider::Provider::Change counts as needing no consent (models, capabilities, paths, auth labels) leaves the fingerprint alone, so it needs nothing here.

valid_alias

$class->valid_alias('acme-prod');    # 1

True for a name of lowercase letters, digits, - and _, at most 32, starting with a letter or digit. It has no dot, colon or slash, so it can never be taken for a host or URL.

valid_credential_env

True for a name of an environment variable ([A-Za-z_][A-Za-z0-9_]*).

auth_types

my @types = $class->auth_types($manifest, $origin);

The auth types the endpoints of $manifest ask for, sorted, each once; empty for a provider that asks for none.

fingerprint

my $hex = $class->fingerprint($manifest, $origin, $allow_internal, $credential_env);

The digest the entry pins: the consent fingerprint of the manifest plus the two binding settings that are part of the pin class. $credential_env is undef for a provider that asks for no auth.

entry

my $entry = $class->entry($manifest, $origin,
  allow_internal => $bool, credential_env => $name, now => $epoch);

The hash to store (see "DESCRIPTION"). $origin is the origin, or any URL of it, the manifest was fetched from. Croaks on an invalid credential_env.

problem

my $why = $class->problem($entry);

Why a stored entry (hand-edited, or from a newer raider) cannot be used, or undef. Nothing in it is trusted beyond its shape.

summary

my $row = $class->summary($alias, $entry);

The stored entry as a flat, display-safe hash for provider list|show, config explain and the REPL: alias, origin, issuer, auth (a list), credential_env (or undef), allow_internal (0 or 1), pinned_at, fingerprint and, when the entry cannot be used ("problem"), problem. Never reads the environment: whether the variable is set is not part of it.

verify

my $why = $class->verify($entry, $manifest, $origin);

Compares a fetched $manifest (from $origin) with the accepted $entry. undef when it is what was accepted -- the same "fingerprint". Otherwise one line naming what differs: the origin, the issuer and the auth types where they changed, else only that endpoints or the binding itself differ. A change of the model list, capabilities or a path never lands here (Langertha::Raider::Provider::Change).

SEE ALSO

SUPPORT

Issues

Please report bugs and feature requests at https://github.com/Getty/langertha-raider/issues.

IRC

Join #langertha on irc.perl.org or message Getty directly.

CONTRIBUTING

Contributions are welcome! Please fork the repository and submit a pull request.

AUTHOR

Torsten Raudssus <torsten@raudssus.de> https://raudssus.de/

COPYRIGHT AND LICENSE

This software is copyright (c) 2026 by Torsten Raudssus.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.

https://raudssus.de/