Struct ContextVerifier 

pub struct ContextVerifier { /* private fields */ }

Verifier for context tokens with a fluent builder for exclusion checks.

.verify() always enforces the signature + expiration. Each .excludes(...) asserts a candidate exposure({label}) fact into the authorizer; if the token carries a matching reject if exposure({label}) rule (added by any signer, in any block), that reject fires and authorization fails. No trusting scope is involved – reject rules apply to the whole token.

Example

use hessra_context_token::{HessraContext, ContextVerifier, add_exposure};
use hessra_token_core::{KeyPair, TokenTimeConfig};

let keypair = KeyPair::new();
let public_key = keypair.public();

let token = HessraContext::new("agent:test".to_string(), TokenTimeConfig::default())
    .issue(&keypair)
    .expect("Failed to mint context token");

let exposed = add_exposure(
    &token,
    &keypair,
    &["PII:email".to_string()],
    "data:user-profile".to_string(),
).expect("Failed to add exposure");

// Passes -- "PII:SSN" is not attested.
ContextVerifier::new(exposed.clone(), public_key)
    .excludes("PII:SSN")
    .verify()
    .expect("clean of PII:SSN");

// Fails -- "PII:email" is attested.
assert!(ContextVerifier::new(exposed, public_key)
    .excludes("PII:email")
    .verify()
    .is_err());

Implementations

impl ContextVerifier

pub fn new(token: String, public_key: PublicKey) -> Self

Creates a new context verifier.

pub fn excludes(self, label: impl Into<String>) -> Self

Add an exposure label that must NOT be present in the token.

Chainable. Each call asserts one candidate exposure({label}) fact; if the token rejects any of them, the grant is blocked (OR semantics across all excluded labels).

pub fn verify(self) -> Result<(), TokenError>

Run authorization.

Always enforces signature + expiration. Each .excludes(...) label is asserted as an exposure({label}) fact in a single authorizer pass; a matching reject if exposure({label}) rule anywhere in the token fires the reject and fails verification.