Struct Verifier 

pub struct Verifier { /* private fields */ }

Decides whether a token allows an access request, and for how long.

Implementations

impl Verifier

pub fn new(root_key: PublicKey, policies: &str) -> Result<Self, Error>

Creates a verifier accepting tokens signed by root_key, and applying policies (Datalog policies, see DEFAULT_POLICY).

pub fn root_key(&self) -> PublicKey

The root public key tokens must be signed with.

pub fn authorize( &self, token: &str, request: &AccessRequest, revoked: &RevocationList, lifetime: Duration, ) -> Result<Authorization, Error>

Checks that token allows request, and finds how long it keeps allowing it, up to lifetime.

Token checks are arbitrary Datalog, so the expiry cannot be read from them. Instead the request is evaluated at each second (the resolution of Biscuit dates) from request.time, and the window stops at the first refusal: credentials bounded by Authorization::valid_until never outlive what the token allows, whatever its time checks are.

Only a policy refusal ends the window; any other failure (execution limits, Datalog errors) rejects the whole request.

Trait Implementations

impl Clone for Verifier

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Verifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.