Struct DpopNonceStore 

pub struct DpopNonceStore { /* private fields */ }

In-memory LRU nonce replay store.

Keys are (nonce, capability_id) pairs. Values are the Instant when the nonce was first seen. A nonce is rejected if it is still within the TTL window when seen a second time.

This is intentionally synchronous (no async) and uses std::sync::Mutex so it integrates cleanly into the Guard pipeline.

Implementations

impl DpopNonceStore

pub fn new(capacity: usize, ttl: Duration) -> Self

Create a new nonce store.

capacity is the maximum number of (nonce, capability_id) pairs to remember. ttl is how long a nonce is considered “live” after first use. After the TTL elapses, the same nonce can be used again.

pub fn check_and_insert( &self, nonce: &str, capability_id: &str, ) -> Result<bool, KernelError>

Check a nonce and insert it if not already live.

Returns Ok(true) if the nonce is fresh (accepted). Returns Ok(false) if the nonce was already used within the TTL window (rejected – replay detected). Returns Err if the internal mutex is poisoned (fail-closed: deny).