Module token_authority 

Token authority (ADR-102 D3/D4, ADR-103 user role).

The daemon is the single issuer and validator of bearer tokens. A token is a 256-bit random secret shown once to the issuer; only its SHA-256 is kept. Every issue and revoke is a chain event, so the table is rebuilt at boot as issued - revoked - expired.

The chain carries the SHA-256 of the secret (needed to validate after a restart) but never the secret itself. The 16-hex token id is the first 16 characters of that hash, so the hash reveals nothing that helps an attacker: a 256-bit preimage is not searchable.

Scope is TokenScope::Owner (full surface, ADR-102 D4, an owner decision): a token is owner-equivalent, including lifecycle verbs such as kernel.shutdown, with one exception enforced in the daemon: a token cannot issue, revoke or list tokens. TTL is the limit: default 15 minutes, maximum 24 hours.

Durability: the chain is saved only on clean shutdown, so a revocation held only on the chain would fail open after a crash. Each revoke is therefore also appended to a small fsynced journal (TokenAuthority::with_journal) before it is acknowledged. The journal holds revocations ONLY and rebuild accepts issued events only from the chain: anyone who can write the journal file could otherwise mint an owner token for a secret of their choosing. A forged revoke is at worst a denial of service. Losing an issue in a crash fails closed (the token does not validate), which is acceptable.

Structs

Issuer

Who asked for the token (recorded on the chain, unverified in Phase 1).

TokenAuthority

The token table, backed by chain events.

TokenInfo

Public metadata of a live token. Never contains the secret or hash.

Enums

TokenError

Why an issue was refused.

TokenScope

What a token grants.

Constants

DEFAULT_TTL

Default token lifetime.

KIND_ISSUED

Chain event kind for an issue.

KIND_REVOKED

Chain event kind for a revoke.

MAX_LABEL_LEN

Longest accepted label, in characters.

MAX_TTL

Longest token lifetime accepted.

SECRET_PREFIX

Prefix on issued secrets, so a leaked one is recognisable.

SOURCE

Chain event source for token events.