Struct ConsentReceipt 

pub struct ConsentReceipt {
    pub provider_id: String,
    pub scope: EgressScope,
    pub provider_name: String,
    pub provider_version: String,
    pub grantor: Grantor,
    pub granted_at: String,
    pub expires_at: Option<String>,
}

An audit-grade record that consent was granted for one provider to send content under one egress scope (docs/context-reuse.md §3).

It pins the provider’s identity at grant time (so a later rename can’t retroactively rewrite what was agreed), names the Grantor, and carries an optional expiry.

Fields

provider_id: String

The provider id (host routing/consent key) this receipt authorizes.

scope: EgressScope

The egress scope consented to. Content leaving this provider under this scope is authorized; any other off-machine scope it declares is not, until its own receipt exists.

provider_name: String

The provider’s declared name at grant time — pinned so the audit trail survives the provider being renamed or swapped.

provider_version: String

The provider’s declared version at grant time.

grantor: Grantor

Who granted consent (a human or a policy).

granted_at: String

When consent was granted (RFC 3339), supplied by the host’s clock.

expires_at: Option<String>

When consent expires (RFC 3339), if it does. None ⇒ open-ended.

Implementations

impl ConsentReceipt

pub fn new( provider_id: impl Into<String>, info: &ProviderInfo, scope: EgressScope, grantor: Grantor, granted_at: impl Into<String>, ) -> Self

Record consent for provider to egress under scope, granted by grantor at granted_at (an RFC 3339 instant from the host’s clock). The provider’s identity is copied out of info and pinned into the receipt. Open-ended by default; add an expiry with with_expiry.

pub fn with_expiry(self, expires_at: impl Into<String>) -> Self

Set the receipt’s expiry (RFC 3339).

pub fn is_live(&self, now: &str) -> bool

Whether this receipt is still live at now (an RFC 3339 instant). A receipt with no expiry is always live; otherwise it is live while now < expires_at.

The comparison is lexicographic on the RFC 3339 strings, which is correct for fixed-width UTC (Z) timestamps — the form a host stamps — so liveness needs no calendar parsing and the type stays dependency-free. The runtime consent gate is presence-based (it does not carry a clock); a host that enforces expiry consults this against its own now.

Trait Implementations

impl Clone for ConsentReceipt

fn clone(&self) -> ConsentReceipt

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConsentReceipt

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ConsentReceipt

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ConsentReceipt

impl PartialEq for ConsentReceipt

fn eq(&self, other: &ConsentReceipt) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for ConsentReceipt

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ConsentReceipt