Struct CapabilityVerifier 

pub struct CapabilityVerifier { /* private fields */ }

Builder for verifying Hessra capability tokens with flexible configuration.

By default, capability verification only checks resource + operation. Subject verification is optional via .with_subject().

Example

use hessra_cap_token::{CapabilityVerifier, HessraCapability};
use hessra_token_core::{KeyPair, TokenTimeConfig};

let keypair = KeyPair::new();
let public_key = keypair.public();
let token = HessraCapability::new(
    "user123".to_string(),
    "resource456".to_string(),
    "read".to_string(),
    TokenTimeConfig::default(),
)
.issue(&keypair)?;

// Basic capability verification (no subject check)
CapabilityVerifier::new(
    token.clone(),
    public_key,
    "resource456".to_string(),
    "read".to_string(),
)
.verify()?;

// With optional subject verification
CapabilityVerifier::new(
    token.clone(),
    public_key,
    "resource456".to_string(),
    "read".to_string(),
)
.with_subject("user123".to_string())
.verify()?;

Implementations

impl CapabilityVerifier

pub fn new( token: String, public_key: PublicKey, resource: String, operation: String, ) -> Self

Creates a new capability verifier for a base64-encoded token.

Arguments

• token - The base64-encoded capability token to verify
• public_key - The public key used to verify the token signature
• resource - The resource identifier to verify
• operation - The operation to verify

pub fn with_subject(self, subject: String) -> Self

Adds an optional subject verification check.

When set, the authorizer adds a check that the minted subject matches. This is optional – pure capability verification does not require it.

Arguments

• subject - The subject to verify in the token’s right fact

pub fn with_namespace(self, namespace: String) -> Self

Adds a namespace restriction to the verification.

Arguments

• namespace - The namespace to verify against (e.g., “example.com”)

pub fn with_designation(self, label: String, value: String) -> Self

Adds a designation fact to the verification.

Each designation provides a designation(label, value) fact that the token’s designation checks will verify against.

Arguments

• label - The designation dimension (e.g., “tenant_id”)
• value - The specific value (e.g., “t-123”)

pub fn verify(self) -> Result<(), TokenError>

Performs the token verification with the configured parameters.

Returns

• Ok(()) - If the token is valid and meets all verification requirements
• Err(TokenError) - If verification fails for any reason