Struct ContextVerifier 

pub struct ContextVerifier { /* private fields */ }

Verifier for context tokens.

Checks that the context token is valid (not expired, properly signed).

Example

use hessra_context_token::{HessraContext, ContextVerifier};
use hessra_token_core::{KeyPair, TokenTimeConfig};

let keypair = KeyPair::new();
let public_key = keypair.public();

let token = HessraContext::new("agent:test".to_string(), TokenTimeConfig::default())
    .issue(&keypair)
    .expect("Failed to create context token");

ContextVerifier::new(token, public_key)
    .verify()
    .expect("Should verify");

Implementations

impl ContextVerifier

pub fn new(token: String, public_key: PublicKey) -> Self

Creates a new context verifier.

Arguments

• token - The base64-encoded context token to verify
• public_key - The public key used to verify the token signature

pub fn verify(self) -> Result<(), TokenError>

Verify the context token.

Checks that:

• The token signature is valid
• The token has not expired

Returns

• Ok(()) - If the token is valid
• Err(TokenError) - If verification fails

pub fn check_precluded_exposures( self, precluded: &[String], ) -> Result<(), TokenError>

Check that the context token does not contain any precluded exposure labels.

Verifies the token (signature + expiration) and then checks that none of the token’s exposure(...) facts match the precluded labels. Any match causes the method to return an error.

This is the authorization-grade check. For diagnostics, use extract_exposure_labels or inspect_context_token instead.

Implementation Note

Exposure facts live in first-party appended blocks. In biscuit-auth v6, authorizer deny-policies cannot see these facts due to block scoping (Scope::Previous is a no-op for the authorizer). Instead, we verify the token cryptographically first, then inspect the verified block data for precluded labels. The authorization decision is fully encapsulated – callers never handle raw labels.

Arguments

• precluded - Labels that must NOT be present in the token’s exposure facts. Any match blocks the grant (OR semantics).

Returns

• Ok(()) - If no precluded labels are found (or precluded list is empty)
• Err(TokenError) - If the token contains any precluded exposure label, or if the token is invalid/expired