Struct CapabilityStore 

pub struct CapabilityStore { /* private fields */ }

Capability store with both session and persistent storage.

Implementations

impl CapabilityStore

pub fn in_memory() -> Self

Create an in-memory only store (no persistence).

pub fn with_persistence(path: impl AsRef<Path>) -> CapabilityResult<Self>

Create a store with persistence.

Errors

Returns an error if the database cannot be opened or read.

pub fn with_kv_store(store: Arc<dyn KvStore>) -> CapabilityResult<Self>

Create a store backed by an existing KvStore (for shared stores).

Errors

Returns an error if loading existing revoked/used tokens fails.

pub fn add(&self, token: CapabilityToken) -> CapabilityResult<()>

Add a capability token.

Errors

Returns an error if the token is invalid or storage fails.

pub fn get( &self, token_id: &TokenId, ) -> CapabilityResult<Option<CapabilityToken>>

Get a token by ID.

Errors

Returns CapabilityError::TokenRevoked if the token has been revoked, or a storage error if reading fails.

pub fn has_capability(&self, resource: &str, permission: Permission) -> bool

Check if there’s a capability for a resource and permission.

pub fn find_capability( &self, resource: &str, permission: Permission, ) -> Option<CapabilityToken>

Find a token that grants a capability.

pub fn revoke(&self, token_id: &TokenId) -> CapabilityResult<()>

Revoke a token.

Errors

Returns an error if storage operations fail.

pub fn clear_session(&self) -> CapabilityResult<()>

Clear all session tokens.

Errors

Returns an error if the lock cannot be acquired.

pub fn mark_used(&self, token_id: &TokenId) -> CapabilityResult<()>

Mark a single-use token as used.

This should be called after successfully using a single-use token to prevent replay attacks.

Errors

Returns an error if the token was already used or storage fails.

pub fn is_used(&self, token_id: &TokenId) -> bool

Check if a single-use token has been used.

pub fn use_token(&self, token_id: &TokenId) -> CapabilityResult<CapabilityToken>

Validate and optionally consume a token.

For single-use tokens, this marks them as used. For regular tokens, this just validates them.

Errors

Returns an error if the token is invalid, expired, revoked, or already used.

pub fn list_tokens(&self) -> CapabilityResult<Vec<CapabilityToken>>

List all valid tokens.

Errors

Returns an error if storage operations fail.

pub fn cleanup_expired(&self) -> CapabilityResult<usize>

Cleanup expired tokens from persistent storage.

Errors

Returns an error if storage operations fail.

Trait Implementations

impl Debug for CapabilityStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CapabilityStore

fn default() -> Self

Returns the “default value” for a type.