Struct Claims 

pub struct Claims {
    pub issuer: Option<Subject>,
    pub audience: Option<Subject>,
    pub expires_at: Option<UnixTime>,
    pub issued_at: UnixTime,
    pub message_id: MessageId,
    pub sender_key_id: Option<KeyId>,
    pub response_key_id: Option<KeyId>,
    pub response_subject: Option<ResponseSubject>,
    pub in_reply_to: Option<MessageId>,
    pub request_hash: Option<RequestHash>,
}

The claim set carried in a protected header (CWT map, header 15, plus the basil private labels).

One struct for every role; MessageRole validators enforce which fields must / must not be present.

Fields

issuer: Option<Subject>

CWT iss (1).

audience: Option<Subject>

CWT aud (3).

expires_at: Option<UnixTime>

CWT exp (4); when absent the effective expiry is iat + default_ttl from ValidationParams.

issued_at: UnixTime

CWT iat (6). Required.

message_id: MessageId

CWT cti (7). Required; sender-unique inside the replay window.

sender_key_id: Option<KeyId>

-70003: must equal the outer kid on signed/sealed messages.

response_key_id: Option<KeyId>

-70004: the key a response must be sealed to (requests).

response_subject: Option<ResponseSubject>

-70005: where to deliver the response (requests, optional).

in_reply_to: Option<MessageId>

-70001: the request message id this message answers (responses).

request_hash: Option<RequestHash>

-70002: SHA3-256 of the complete request bytes (responses).

Implementations

impl Claims

pub fn validate(&self, params: &ValidationParams) -> Result<(), ClaimsError>

Validate this claim set against params: clock-skew on iat, effective expiry (iat + default_ttl when exp is absent), the max_ttl cap on an explicit span, the audience allow-list, and the role shape.

Errors

The first ClaimsError encountered, in the order above.

pub fn validate_role(&self, role: MessageRole) -> Result<(), ClaimsError>

Validate only the role shape (which basil labels must / must not be present). Builders run this before sealing.

Errors

ClaimsError::MissingClaim / ClaimsError::ForbiddenClaim with the offending label.

Trait Implementations

impl Clone for Claims

fn clone(&self) -> Claims

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Claims

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Claims

impl PartialEq for Claims

fn eq(&self, other: &Claims) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Claims