Struct AuthService 

pub struct AuthService { /* private fields */ }

Centralized credential management service (Factotum pattern).

• Credentials are registered once, encrypted at rest.
• Agents request scoped tokens; raw credentials are never exposed.
• Token issuance and access are audited.
• SHA-256 hashed credentials support agent authentication.

Implementations

impl AuthService

pub fn new(encryption_key: [u8; 32]) -> Self

Create a new AuthService with the given encryption key.

pub fn new_default() -> Self

Create with a default (zero) encryption key (testing only).

pub fn register_credential( &self, name: &str, credential_type: CredentialType, value: &[u8], allowed_agents: Vec<String>, ) -> Result<(), KernelError>

Register a new credential.

pub fn rotate_credential( &self, name: &str, new_value: &[u8], ) -> Result<(), KernelError>

Update an existing credential’s value (rotation).

pub fn request_token( &self, request: &CredentialRequest, ) -> Result<IssuedToken, KernelError>

Request a scoped, time-limited token.

pub fn validate_token(&self, token_id: &str) -> Result<IssuedToken, KernelError>

Validate an issued token. Returns Err if expired or not found.

pub fn revoke_token(&self, token_id: &str) -> bool

Revoke an active token.

pub fn active_token_count(&self) -> usize

List all active (non-expired) tokens.

pub fn register_hashed_credential( &self, agent_id: &str, raw_credential: &[u8], scopes: Vec<String>, ) -> Result<(), KernelError>

Register a hashed credential for an agent.

The raw credential is never stored; only its SHA-256 hash is kept.

pub fn authenticate( &self, agent_id: &str, raw_credential: &[u8], ) -> Result<AuthToken, KernelError>

Authenticate an agent by verifying its raw credential against the stored hash.

On success, issues a scoped AuthToken valid for one hour.

pub fn validate_auth_token( &self, token_id: &str, ) -> Result<AuthToken, KernelError>

Validate an auth token. Returns Err if expired or not found.

pub fn revoke_auth_token(&self, token_id: &str) -> bool

Revoke an auth token. Returns true if it existed.

pub fn check_scope(&self, token_id: &str, required_scope: &str) -> bool

Check whether an auth token has a specific scope.

pub fn audit_log(&self) -> Vec<AuditEntry>

Get the audit log.

Trait Implementations

impl SystemService for AuthService

fn name(&self) -> &str

Human-readable service name.

fn service_type(&self) -> ServiceType

Service type category.

fn start<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<(), Box<dyn Error + Send + Sync>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Start the service.

fn stop<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = Result<(), Box<dyn Error + Send + Sync>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Stop the service.

fn health_check<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = HealthStatus> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Perform a health check.