Crate hessra_token 

Hessra Token

Core verification library for Hessra authentication tokens.

This crate provides functionality for creating, verifying and attesting biscuit tokens used in the Hessra authentication system. It is designed to be WASM-compatible and has no networking dependencies.

Features

• Token creation: Create new tokens with configurable time settings
• Token verification: Verify tokens without contacting the authorization server
• Token attestation: Add service node attestations to tokens
• WASM compatibility: Can be compiled to WebAssembly for use in browsers

Usage

use hessra_token::{create_biscuit, verify_token_local, biscuit_key_from_string, TokenTimeConfig, KeyPair, encode_token};

fn main() -> Result<(), hessra_token::TokenError> {
    // Create a new token
    let keypair = KeyPair::new();
    let token = create_biscuit(
        "user123".to_string(),
        "resource456".to_string(),
        "read".to_string(),
        keypair,
        TokenTimeConfig::default(),
    ).map_err(|e| hessra_token::TokenError::generic(e.to_string()))?;
     
    // Verify the token
    let token_string = encode_token(&token);
    let public_key = biscuit_key_from_string("ed25519/01234567890abcdef".to_string())?;
    verify_token_local(&token_string, public_key, "user123", "resource456", "read")?;
     
    println!("Token creation and verification successful!");
    Ok(())
}

Structs

Biscuit

This structure represents a valid Biscuit token

ServiceNode

TokenTimeConfig

TokenTimeConfig allows control over token creation times and durations This is used to create tokens with custom start times and durations for testing purposes. In the future, this can be enhanced to support variable length tokens, such as long-lived bearer tokens.

Enums

KeyPair

pair of cryptographic keys used to sign a token’s block

PublicKey

the public part of a KeyPair

TokenError

Error type for hessra-token operations

Functions

add_multi_party_attestation

Add a multi-party attestation to a token

add_multi_party_attestation_to_token

Add a multi-party attestation to a base64-encoded token string

add_service_node_attestation

Add a service node attestation to a token

biscuit_key_from_string

Takes a public key encoded as a string in the format “ed25519/…” or “secp256r1/…” and returns a PublicKey.

create_biscuit

Creates a new biscuit token with the specified subject and resource.

create_multi_party_biscuit

Creates a new biscuit token with multi-party attestations.

create_multi_party_biscuit_with_time

Creates a new biscuit token with multi-party attestations and custom time settings.

create_multi_party_token

Creates a new multi-party biscuit token with default time configuration.

create_multi_party_token_with_time

create_raw_multi_party_biscuit

Creates a new biscuit token with multi-party attestations.

create_service_chain_biscuit

Creates a new biscuit token with service chain attestations. Creates a new biscuit token with service chain attestations.

create_service_chain_token

Creates a service chain biscuit token with default time configuration.

create_service_chain_token_with_time

Creates a service chain biscuit token with custom time configuration.

create_token

Creates a biscuit token with default time configuration.

create_token_with_time

Creates a biscuit token with custom time configuration.

decode_token

Decode a URL-safe base64 encoded token string to binary

encode_token

Encode binary token data to URL-safe base64 string

parse_token

Extracts and parses a Biscuit token from a URL-safe base64 string

public_key_from_pem_file

verify_biscuit_local

Verifies a Biscuit authorization token locally without contacting the authorization server.

verify_service_chain_biscuit_local

verify_service_chain_token_local

verify_token_local

Verifies a Biscuit authorization token locally without contacting the authorization server.