Struct PermissionCard 

pub struct PermissionCard { /* private fields */ }

A permission card held by the calling component.

The card wraps a host resource handle. It has no public constructor, it cannot be built from a CardId or from data, and it cannot be serialized.

Borrowing operations (id, parents, expires_at, inspect, derive) leave the card in place. Consuming operations (revoke, install) and passing the card as an agent method argument or return value move the host handle out of the card. Every later use of a moved card panics.

Dropping a card releases the caller’s handle. It does not revoke the card and does not remove it from the caller’s wallet.

Decoding a card from an agent method argument or result (FromSchema, FromWire) takes the handle out of the decoded value, so a second decode of the same value fails and two card objects never share one handle. Safe code cannot build such a value without an existing handle. The golem-schema codec handle types expose hidden constructors and accessors that can alias a handle the component already holds, and wit-bindgen’s unsafe resource constructors can name any handle number. Neither path creates authority: the host validates every handle against the component’s own resource table.

Implementations

impl PermissionCard

pub fn id(&self) -> CardId

The identifier of this card.

Panics

Panics if the card was moved. The host traps if the card was revoked or is unknown.

pub fn parents(&self) -> Vec<CardId>

The identifiers of the cards this card was derived from.

Panics

Panics if the card was moved. The host traps if the card was revoked or is unknown.

pub fn expires_at(&self) -> Option<Timestamp>

The expiry time of this card, or None for a card without a lifespan.

Panics

Panics if the card was moved. The host traps if the card was revoked or is unknown.

pub fn inspect(&self) -> Result<CardView, PermissionError>

Returns the four grant lists of this card. Requires card:inspect.

Panics

Panics if the card was moved.

pub fn derive( &self, bounds: &Bounds, lifespan: Option<&Lifespan>, ) -> Result<PersistentCard, PermissionError>

Derives a child card from this card. Requires card:derive.

The positive lists of bounds select the grants of this card that the child retains. The negative lists of bounds are denials that the child adds. The child’s lifespan cannot exceed the lifespan of this card. The host selects the child’s kind, independently of this card’s kind.

Panics

Panics if the card was moved.

pub fn revoke(self) -> Result<u32, PermissionError>

Revokes this card and every card derived from it. Requires card:revoke.

Returns the number of revoked cards. The card is moved even when the host refuses the revocation.

Panics

Panics if the card was already moved.

pub fn install(self, target: &Holder) -> Result<(), PermissionError>

Installs this card into the wallet of target. Requires card:install.

The host currently accepts only Holder::Agent targets and refuses account and application targets with PermissionError::NotPermitted. A target that does not match the card’s recipient pattern fails with PermissionError::InstallRecipientMismatch. The card is moved even when the host refuses the installation.

Panics

Panics if the card was already moved.

Trait Implementations

impl Debug for PermissionCard

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> From<&'a PermissionCard> for ScopeParent<'a>

fn from(card: &'a PermissionCard) -> Self

Converts to this type from the input type.

impl FromWire for PermissionCard

fn read_wire(reader: &mut WireReader, index: i32) -> Result<Self, WireError>

Takes the handle out of the decoded node. Decoding the same node again, for example from a second reader over a shared snapshot, fails.

fn read_result_payload( reader: &mut WireReader, index: Option<i32>, ) -> Result<Self, WireError>

impl IntoWire for PermissionCard

fn preflight(&self, resources: &mut WirePreflight) -> Result<(), WireError>

fn write_wire(&self, writer: &mut WireWriter) -> Result<i32, WireError>

const NEEDS_PREPARATION: bool = true

False only when prepare_wire is a no-op for every value of this type. Resource preflight still runs regardless of this flag. Custom and derived implementations prepare by default, including those with no stream schema.

async fn prepare_wire(&self) -> Result<(), WireError>

Wrap native stream endpoints without reading from them. This is called only after the complete value has passed resource preflight.

fn write_result_payload( &self, writer: &mut WireWriter, ) -> Result<Option<i32>, WireError>

impl WireSchema for PermissionCard

fn wire_type_id() -> String

fn append_schema(builder: &mut WireSchemaBuilder) -> i32

const IS_UNIT: bool = false

fn contains_stream(seen: &mut HashSet<&'static str>) -> bool