Struct ContextVerifier 

pub struct ContextVerifier { /* private fields */ }

Verifier for context tokens with a fluent builder for exclusion checks.

.verify() always enforces the signature + expiration. Each .excludes(...) accumulates a Datalog deny rule scoped with trusting authority, {pubkey}, so authorization fails if the token carries any of the excluded exposure labels attested by the issuer.

Example

use hessra_context_token::{HessraContext, ContextVerifier, add_exposure};
use hessra_token_core::{KeyPair, TokenTimeConfig};

let keypair = KeyPair::new();
let public_key = keypair.public();

let token = HessraContext::new("agent:test".to_string(), TokenTimeConfig::default())
    .issue(&keypair)
    .expect("Failed to mint context token");

let exposed = add_exposure(
    &token,
    &keypair,
    &["PII:email".to_string()],
    "data:user-profile".to_string(),
).expect("Failed to add exposure");

// Passes -- "PII:SSN" is not attested.
ContextVerifier::new(exposed.clone(), public_key)
    .excludes("PII:SSN")
    .verify()
    .expect("clean of PII:SSN");

// Fails -- "PII:email" is attested.
assert!(ContextVerifier::new(exposed, public_key)
    .excludes("PII:email")
    .verify()
    .is_err());

Implementations

impl ContextVerifier

pub fn new(token: String, public_key: PublicKey) -> Self

Creates a new context verifier.

pub fn excludes(self, label: impl Into<String>) -> Self

Add an exposure label that must NOT be present in the token.

Chainable. Each call accumulates one deny rule; any match blocks the grant (OR semantics across all excluded labels).

pub fn verify(self) -> Result<(), TokenError>

Run authorization.

Always enforces signature + expiration. If any .excludes(...) labels were registered, each is checked via a Datalog deny rule scoped to trusting authority, {pubkey} so only issuer-attested facts can trigger the deny.