Struct MacaroonManager 

pub struct MacaroonManager { /* private fields */ }

Macaroon minting and verification.

Implementations

impl MacaroonManager

pub fn new(root_key: &[u8]) -> Result<Self>

Create a manager from a root key.

The root key should be at least 32 bytes of cryptographically random data.

pub fn create(&self, location: &str, identifier: &str) -> Macaroon

Mint a new macaroon with the given identifier.

pub fn add_first_party_caveat(&self, macaroon: &mut Macaroon, predicate: &str)

Add a first-party caveat, updating the signature chain.

pub fn add_third_party_caveat( &self, macaroon: &mut Macaroon, location: &str, caveat_id: &str, caveat_key: &[u8], )

Add a third-party caveat.

Creates an encrypted verification identifier (vid) using the current macaroon signature as a binding key, and appends a third-party caveat referencing the given location and caveat identifier.

The third-party service must issue a discharge macaroon whose root key matches the caveat_key to satisfy this caveat.

pub fn verify_with_discharges<F>( &self, macaroon: &Macaroon, verifier: F, discharge_macaroons: &[Macaroon], ) -> Result<()>

where F: Fn(&str) -> bool,

Verify a macaroon by replaying the HMAC chain and checking caveats.

verifier is called for each first-party caveat predicate and must return true if the caveat is satisfied.

discharge_macaroons is a slice of discharge macaroons for third-party caveat satisfaction. Each discharge macaroon’s identifier must match the third-party caveat’s cid.

pub fn verify<F>(&self, macaroon: &Macaroon, verifier: F) -> Result<()>

where F: Fn(&str) -> bool,

Verify a macaroon (first-party caveats only — convenience wrapper).

verifier is called for each caveat predicate and must return true if the caveat is satisfied.

pub fn attenuate(&self, macaroon: &Macaroon, predicates: &[&str]) -> Macaroon

Attenuate (create a restricted copy of) a macaroon with additional caveats.