Struct HmacSigner 

pub struct HmacSigner { /* private fields */ }

HMAC-SHA256 signer over a KeyRing (ADR 0006, ADR 0014).

Cheap to clone: the ring, clock, binding and policy live behind one Arc. Debug shows key ids and states only — never key material (issue #135).

Implementations

impl HmacSigner

pub fn new( current_secret: impl Into<String>, previous_secret: Option<String>, ) -> Result<Self, SignerError>

The environment shape of ADR 0006: HARNESS_SECRET signs, the optional HARNESS_SECRET_PREVIOUS verifies only. No venture/env binding and the default TokenPolicy; runtimes build the bound signer through crate::HarnessConfig::signer, where those fields come from config (issue #137).

Errors

SignerError::SecretTooShort when the current secret is shorter than MIN_SECRET_BYTES.

pub fn from_ring(ring: KeyRing) -> Self

A signer over an already-built ring: crate::SystemClock, no binding, default TokenPolicy. Apply with_clock, with_binding and with_policy before handing it out.

pub fn with_clock(self, clock: Arc<dyn Clock>) -> Self

Overrides the clock used for expiry checks and lifetime clamping (the Clock port is the only time source in core, architecture section 5).

pub fn with_binding(self, venture: Option<String>, env: Option<String>) -> Self

Stamps and enforces the venture/environment binding (issue #137). The labels come from config (HARNESS_VENTURE, ENV); a token minted under one binding never verifies under another. With both None the signer stays unbound — the pre-#137 shape, kept for tests and hand-built rings.

pub fn with_policy(self, policy: TokenPolicy) -> Self

Replaces the per-purpose lifetime policy.

pub fn ring_states(&self) -> Vec<(Kid, KeyState)>

The ring this signer verifies against (ids and states only).

Trait Implementations

impl Clone for HmacSigner

fn clone(&self) -> HmacSigner

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HmacSigner

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Signer for HmacSigner

fn sign(&self, payload: &Payload) -> String

fn verify(&self, token: &str, expected_purpose: &str) -> Option<Payload>

None for malformed input, tampering, expiry, wrong purpose, a revoked key id, or a venture/environment binding mismatch; never panics on malformed input.