Struct ApiKeyEntry 

pub struct ApiKeyEntry {
    pub name: String,
    pub hash: String,
    pub expires_at: Option<u64>,
    pub created_at: u64,
    pub namespaces: Vec<String>,
    pub admin: bool,
    pub roles: Vec<String>,
}

A stored API key entry with metadata.

Fields

name: String

Human-readable name for this key.

hash: String

Argon2 hash of the key.

expires_at: Option<u64>

Optional Unix timestamp (seconds) when this key expires.

created_at: u64

When the key was created (Unix seconds).

namespaces: Vec<String>

Namespaces this key may act in.

Empty means unrestricted — the key may name any namespace. That is the right default for a single-tenant deployment, where the header is always default and binding it would be ceremony. It is the wrong default for a multi-tenant one, which is why chronixd refuses to start multi-tenant with an unrestricted key rather than silently handing every tenant’s data to every key.

admin: bool

Whether this key may perform administrative operations.

Restore, namespace management and key management are all reachable with an ordinary key otherwise, because the Cedar authorization engine is optional and its absence used to mean “permit”.

roles: Vec<String>

Cedar roles this key carries, as Chronix::Role memberships.

A key had none, so every policy in the documentation — all of them written as principal in Chronix::Role::"…" — matched nothing when the caller authenticated with the credential chronixd is usually deployed with. Roles were resolvable from a JWT claim alone, and only inside the administrative gate.

Implementations

impl ApiKeyEntry

pub fn allows_namespace(&self, namespace: &str) -> bool

Whether this key may act in namespace.

Trait Implementations

impl Clone for ApiKeyEntry

fn clone(&self) -> ApiKeyEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ApiKeyEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ApiKeyEntry

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ApiKeyEntry

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.