Struct AccessToken 

pub struct AccessToken {
    pub hash: String,
    pub principal_id: String,
    pub label: String,
    pub created: UnixMillis,
    pub last_used: Option<UnixMillis>,
    pub expires: Option<UnixMillis>,
}

A registered access token: the credential smart HTTP authenticates with

Why this is not a second identity model

It is a second authentication method for the identity model that already exists. A token names a Principal and nothing else. It carries no grant, no level and no scope, so every authorisation question it can produce is still answered by AuthTable::may against that principal’s grants — the same call, on the same table, that an SSH key produces. Revoking the token removes a way in; it changes nobody’s access.

The secret is not here, and cannot be

Self::hash is the SHA-256 of the token secret, hex, and it is also the key this record is stored under. That is deliberate on both counts:

• the stored table never holds a usable credential, so a leaked auth document (it is a git blob, and every version of it is kept — see doc) does not hand anybody a login;
• a lookup is hash the presented secret, probe once, which is O(1) and does not walk the token list. A table keyed by anything else would either scan on every HTTP request or need a second index to avoid it.

The hash is therefore also the token’s public id: it is what gunnar admin token list prints and what revocation names. Printing a hash is safe; printing the secret again is not possible, which is the point.

Fields

hash: String

SHA-256 of the secret, lowercase hex. The primary key, and the id an operator sees.

principal_id: String

Which principal this token authenticates.

label: String

An operator-supplied label: which laptop, which CI job. Never part of the credential.

created: UnixMillis

When it was created.

last_used: Option<UnixMillis>

When it last authenticated, if ever.

expires: Option<UnixMillis>

When it stops being accepted, if ever.

Implementations

impl AccessToken

pub fn is_valid_at(&self, now: UnixMillis) -> bool

Is this token still valid at now?

Same shape as PublicKey::is_valid_at and deliberately so: expiry is one rule, and two credentials that expired by different arithmetic would be two rules (one implementation).

Trait Implementations

impl Clone for AccessToken

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AccessToken

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AccessToken

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AccessToken

impl PartialEq for AccessToken

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for AccessToken

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AccessToken