Struct DualKeyCap 

pub struct DualKeyCap<P>
where
    P: Permission,
{ /* private fields */ }

A dual-authorization capability requiring two independent approvals.

Created via DualKeyCap::new, which consumes a Cap<P> and returns a (DualKeyCap<P>, ApproverA, ApproverB) triple. Both approvers must call approve() before try_cap() will succeed.

Implements Saltzer & Schroeder’s Separation of Privilege principle: no single entity can exercise the capability alone.

!Send + !Sync by default — use make_send for cross-thread transfer. Cloning shares the same approval state.

Implementations

impl<P> DualKeyCap<P>

where P: Permission,

pub fn new(_cap: Cap<P>) -> (DualKeyCap<P>, ApproverA, ApproverB)

Creates a dual-authorization capability by consuming a Cap<P>.

Returns a (DualKeyCap<P>, ApproverA, ApproverB) triple. Distribute the approver handles to separate subsystems to enforce separation of privilege.

pub fn try_cap(&self) -> Result<Cap<P>, CapSecError>

Attempts to obtain a Cap<P> from this dual-authorization capability.

Returns Ok(Cap<P>) if both approvers have called approve(), or Err(CapSecError::InsufficientApprovals) if not.

pub fn is_active(&self) -> bool

Advisory check — returns true if both approvals have been granted.

pub fn make_send(self) -> DualKeySendCap<P>

Converts this capability into a DualKeySendCap that can cross thread boundaries.

Trait Implementations

impl<P> CapProvider<P> for DualKeyCap<P>

where P: Permission,

fn provide_cap(&self, _target: &str) -> Result<Cap<P>, CapSecError>

Provides a Cap<P> for the given target, or returns an error if the target is outside the capability’s scope.

impl<P> Clone for DualKeyCap<P>

where P: Permission,

fn clone(&self) -> DualKeyCap<P>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.