Struct ExternalCommitPolicyV1 

pub struct ExternalCommitPolicyV1 {
    pub allow_external_commit: bool,
    pub expires_at_ns: u64,
    pub expire_in_ns: u64,
    pub symmetric_key: Vec<u8>,
    pub external_group_id: Vec<u8>,
}

v1 external-commit-policy payload. Field-coupling invariants enforced by libxmtp when applying an AppDataUpdate(EXTERNAL_COMMIT_POLICY) proposal:

• When allow_external_commit transitions to true: symmetric_key and external_group_id MUST be populated (non-empty, meeting their length requirements) in the same proposal. The two transitions are atomic — there is no window where the bit is on but the invite coordinates are unset.

• When allow_external_commit transitions to false (revoke): symmetric_key and external_group_id MUST be cleared (set to empty bytes) in the same proposal. Leaving stale coordinates in the group state after revoke would let a future re-enable accidentally revive a previously-distributed key.

• On re-enable (false → true after a prior revoke): the new symmetric_key MUST differ from every previously-used value for this group, and the new external_group_id SHOULD differ as well. Reusing a revoked key would re-validate every QR ever printed under that key, defeating the revocation. Admin clients are responsible for generating fresh material on each enable.

Fields

allow_external_commit: bool

Master switch for MLS External Commits adding new members. Required for the QR-invite flow. Defaults to false; admins (super-admin by default) opt in via AppDataUpdate(EXTERNAL_COMMIT_POLICY).

See the field-coupling invariants in the message-level comment above: enabling MUST populate symmetric_key + external_group_id; revoking (true → false) MUST clear them.

expires_at_ns: u64

Wall-clock auto-disable timestamp (ns since UNIX epoch). 0 = no automatic expiry. After this timestamp the validator rejects all external commits regardless of allow_external_commit. Lets admins issue time-bounded invite campaigns without having to come back and flip the bit manually.

expire_in_ns: u64

Maximum staleness of the GroupInfo referenced by an external commit, in nanoseconds since GroupInfo export. 0 = no staleness limit. External commits whose referenced GroupInfo was exported more than expire_in_ns ago are rejected. Narrows the replay window for stolen-blob attacks and forces re-export frequency.

symmetric_key: Vec<u8>

32-byte ChaCha20Poly1305 key used to wrap the EncryptedGroupInfoBlob for the currently-active invite. Carried in the group state so any member (especially a just-joined external committer) can re-export GroupInfo and re-upload a refreshed blob under the same key after a join — without this, a printed QR / link would die the moment the issuing admin went offline.

The QR carries the same key bytes. Rotation = admin sets a new value here in a single AppDataUpdate(EXTERNAL_COMMIT_POLICY) proposal AND issues a new QR carrying the matching key; old QR holders’ keys no longer decrypt blobs the service serves under the rotated slot.

Length MUST be exactly 32 bytes when populated. Empty (zero-length) means no active invite — and MUST coincide with allow_external_commit == false (see the field-coupling invariants at the top of this message). Revoking the invite MUST clear this field; re-enabling MUST populate it with a freshly-generated value distinct from any previously-used key for this group.

Note: the service_pointer (where the blob lives) is intentionally NOT stored in the group. It is per-QR application-defined opaque bytes; different invites for the same group may point at different services. Joiners use the service_pointer from the QR they scanned.

external_group_id: Vec<u8>

Identifier for the service slot holding the active invite’s encrypted blob. Application-defined opaque bytes (UUID, snowflake, short slot key, etc.); decoupled from the MLS group_id. Admins MAY rotate the symmetric_key while keeping this stable (overwrite the same slot on the service) or change both together (new slot, leaves the old slot orphaned for application-side GC).

The QR carries the same value. The joiner verifies that the QR’s external_group_id equals this field after joining, as defense-in-depth against a stale or swapped QR. Mismatch indicates the admin rotated to a new slot after the QR was minted; the joining client SHOULD treat the just-published commit as orphaned (it validates fine, but the refreshed blob the joiner would upload to the old slot will not be reachable by holders of the new QR).

MUST be at least 4 bytes when populated (collision-avoidance floor for tiny services). RECOMMENDED: 16 random bytes when no application-specific scheme is in use. Empty (zero-length) means no active invite — and MUST coincide with allow_external_commit == false (see the field-coupling invariants at the top of this message). Revoking the invite MUST clear this field; re-enabling SHOULD use a freshly-generated value (reusing a prior external_group_id is permitted only when the admin intends to overwrite the old service slot — typically the admin generates a new value to leave the prior slot orphaned).

Trait Implementations

impl Clone for ExternalCommitPolicyV1

fn clone(&self) -> ExternalCommitPolicyV1

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ExternalCommitPolicyV1

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ExternalCommitPolicyV1

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ExternalCommitPolicyV1

fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>

where D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Hash for ExternalCommitPolicyV1

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Message for ExternalCommitPolicyV1

fn encoded_len(&self) -> usize

Returns the encoded length of the message without a length delimiter.

fn clear(&mut self)

Clears the message, resetting all fields to their default.

fn encode(&self, buf: &mut impl BufMut) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message to a buffer.

fn encode_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message to a newly allocated buffer.

fn encode_length_delimited( &self, buf: &mut impl BufMut, ) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message with a length-delimiter to a buffer.

fn encode_length_delimited_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message with a length-delimiter to a newly allocated buffer.

fn decode(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes an instance of the message from a buffer.

fn decode_length_delimited(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes a length-delimited instance of the message from the buffer.

fn merge(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes an instance of the message from a buffer, and merges it into self.

fn merge_length_delimited(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes a length-delimited instance of the message from buffer, and merges it into self.

impl Name for ExternalCommitPolicyV1

const NAME: &'static str = "ExternalCommitPolicyV1"

Simple name for this Message. This name is the same as it appears in the source .proto file, e.g. FooBar.

const PACKAGE: &'static str = "xmtp.mls.message_contents"

Package name this message type is contained in. They are domain-like and delimited by ., e.g. google.protobuf.

fn full_name() -> String

Fully-qualified unique name for this Message. It’s prefixed with the package name and names of any parent messages, e.g. google.rpc.BadRequest.FieldViolation. By default, this is the package name followed by the message name. Fully-qualified names must be unique within a domain of Type URLs.

fn type_url() -> String

Type URL for this Message, which by default is the full name with a leading slash, but may also include a leading domain name, e.g. type.googleapis.com/google.profile.Person. This can be used when serializing into the google.protobuf.Any type.

impl PartialEq for ExternalCommitPolicyV1

fn eq(&self, other: &ExternalCommitPolicyV1) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ExternalCommitPolicyV1

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for ExternalCommitPolicyV1

impl StructuralPartialEq for ExternalCommitPolicyV1