Struct DelegationApi 

pub struct DelegationApi;

DelegationApi

Requires auth.delegated_tokens.enabled = true in config.

Implementations

impl DelegationApi

pub fn verify_delegation_proof( proof: &DelegationProof, authority_pid: Principal, ) -> Result<(), Error>

Full delegation proof verification (structure + signature).

Purely local verification; does not read certified data or require a query context.

pub fn sign_token( token_version: u16, claims: DelegatedTokenClaims, proof: DelegationProof, ) -> Result<DelegatedToken, Error>

pub fn verify_token( token: &DelegatedToken, authority_pid: Principal, now_secs: u64, ) -> Result<(), Error>

Full delegated token verification (structure + signature).

Purely local verification; does not read certified data or require a query context.

pub fn verify_token_verified( token: &DelegatedToken, authority_pid: Principal, now_secs: u64, ) -> Result<(DelegatedTokenClaims, DelegationCert), Error>

Verify a delegated token and return verified contents.

This is intended for application-layer session construction. It performs full verification and returns verified claims and cert.

pub async fn provision( request: DelegationProvisionRequest, ) -> Result<DelegationProvisionResponse, Error>

admin-only delegation provisioning (root-only escape hatch).

Not part of canonical delegation flow. Used for tests / tooling due to PocketIC limitations.

Root does not infer targets; callers must supply them.

pub async fn request_delegation( request: DelegationRequest, ) -> Result<DelegationProvisionResponse, Error>

Canonical signer-initiated delegation request (user_shard -> root).

Caller must match signer_pid and be registered to the subnet.

pub fn store_proof( proof: DelegationProof, kind: DelegationProvisionTargetKind, ) -> Result<(), Error>

pub fn require_proof() -> Result<DelegationProof, Error>