Struct HessraCapability 

pub struct HessraCapability { /* private fields */ }

Builder for creating Hessra capability tokens with flexible configuration.

Capability tokens grant access to a resource+operation. The subject field is retained for auditing, but the token no longer requires the verifier to prove who is presenting it. Presenting the capability IS the authorization.

Example

use hessra_cap_token::HessraCapability;
use hessra_token_core::{KeyPair, TokenTimeConfig};

let keypair = KeyPair::new();

// Basic capability token
let token = HessraCapability::new(
    "alice".to_string(),
    "resource1".to_string(),
    "read".to_string(),
    TokenTimeConfig::default()
)
.issue(&keypair)
.expect("Failed to create token");

Implementations

impl HessraCapability

pub fn new( subject: String, resource: String, operation: String, time_config: TokenTimeConfig, ) -> Self

Creates a new capability token builder.

Arguments

• subject - The subject (user) identifier (retained for auditing)
• resource - The resource identifier to grant access to
• operation - The operation to grant access to
• time_config - Time configuration for token validity

pub fn namespace_restricted(self, namespace: String) -> Self

Restricts the capability to a specific namespace.

Adds a namespace restriction check to the authority block:

• check if namespace({namespace})

Arguments

• namespace - The namespace to restrict to (e.g., “myapp.hessra.dev”)

pub fn issue(self, keypair: &KeyPair) -> Result<String, Box<dyn Error>>

Issues (builds and signs) the capability token.

Arguments

• keypair - The keypair to sign the token with

Returns

Base64-encoded biscuit token