Crate hessra_token_authz

Expand description

§Hessra Token Authorization

Authorization token implementation for the Hessra authentication system.

This crate provides functionality for creating, verifying and attesting authorization tokens (biscuit tokens) used in the Hessra authentication system. It supports advanced features like service chain attestation and multi-party authorization.

§Features

Token creation: Create authorization tokens with configurable time settings
Token verification: Verify tokens using identity-based (requires subject) or capability-based (derives subject from token) modes
Service chain attestation: Add service node attestations to tokens
Multi-party authorization: Create tokens requiring multiple party attestations
WASM compatibility: WIP WASM bindings for token verification

§Verification Modes

§Identity-Based Verification

Traditional verification requires an explicit subject (identity) parameter. The verifier checks if the token grants the specific subject access to the resource and operation.

§Capability-Based Verification

Capability-based verification does not require a subject parameter. Instead, the subject is derived from the token’s rights using a Datalog rule. This is useful for services that only care about whether a request has authorization for an action, not who is making the request. For example, a telemetry service might only need to verify write permission, regardless of the identity writing the data.

§Usage

use hessra_token_authz::{create_biscuit, verify_token_local, biscuit_key_from_string};
use hessra_token_core::{TokenTimeConfig, KeyPair, encode_token};

fn main() -> Result<(), hessra_token_core::TokenError> {
    // Create a new token
    let keypair = KeyPair::new();
    let token = create_biscuit(
        "user123".to_string(),
        "resource456".to_string(),
        "read".to_string(),
        keypair,
        TokenTimeConfig::default(),
    ).map_err(|e| hessra_token_core::TokenError::generic(e.to_string()))?;
     
    // Verify the token
    let token_string = encode_token(&token);
    let public_key = biscuit_key_from_string("ed25519/01234567890abcdef".to_string())?;
    verify_token_local(&token_string, public_key, "user123", "resource456", "read")?;
     
    println!("Token creation and verification successful!");
    Ok(())
}

Structs§

AuthorizationVerifier: Builder for verifying Hessra authorization tokens with flexible configuration.
Biscuit: This structure represents a valid Biscuit token
HessraAuthorization: Builder for creating Hessra authorization tokens with flexible configuration.
ServiceNode
TokenTimeConfig: TokenTimeConfig allows control over token creation times and durations This is used to create tokens with custom start times and durations for testing purposes. In the future, this can be enhanced to support variable length tokens, such as long-lived bearer tokens.

Enums§

KeyPair: pair of cryptographic keys used to sign a token’s block
PublicKey: the public part of a KeyPair
TokenError: Detailed error type for hessra-token operations with specific failure information

Functions§

add_multi_party_attestation: Add a multi-party attestation to a token
add_multi_party_attestation_to_token: Add a multi-party attestation to a base64-encoded token string
add_prefix_restriction: Add a prefix restriction to a token
add_prefix_restriction_to_token: Add a prefix restriction to a base64-encoded token string
add_service_node_attestation: Add a service node attestation to a token
biscuit_key_from_string: Takes a public key encoded as a string in the format “ed25519/…” or “secp256r1/…” and returns a PublicKey.
create_biscuit: Creates a new biscuit token with the specified subject and resource.
create_multi_party_biscuit: Creates a new biscuit token with multi-party attestations.
create_multi_party_biscuit_with_time: Creates a new biscuit token with multi-party attestations and custom time settings.
create_multi_party_token: Creates a new multi-party biscuit token with default time configuration.
create_multi_party_token_with_time
create_raw_multi_party_biscuit: Creates a new biscuit token with multi-party attestations.
create_service_chain_biscuit: Creates a new biscuit token with service chain attestations. Creates a new biscuit token with service chain attestations.
create_service_chain_token: Creates a service chain biscuit token with default time configuration.
create_service_chain_token_with_time: Creates a service chain biscuit token with custom time configuration.
create_token: Creates a biscuit token with default time configuration.
create_token_with_time: Creates a biscuit token with custom time configuration.
decode_token: Decode a URL-safe base64 encoded token string to binary
encode_token: Encode binary token data to URL-safe base64 string
get_authorization_revocation_id: Get the revocation ID for an authorization token
get_authorization_revocation_id_from_bytes: Get the revocation ID from raw token bytes
parse_token: Extracts and parses a Biscuit token from a URL-safe base64 string
public_key_from_pem_file
verify_biscuit_local: Verifies a Biscuit authorization token locally without contacting the authorization server.
verify_capability_biscuit_local: Verifies a Biscuit authorization token based on capability (resource + operation) only.
verify_capability_token_local: Verifies a Biscuit authorization token based on capability (resource + operation) only.
verify_service_chain_biscuit_local
verify_service_chain_capability_biscuit_local: Binary version of verify_service_chain_capability_token_local.
verify_service_chain_capability_token_local: Verifies a service chain token based on capability without requiring subject.
verify_service_chain_token_local
verify_token_local: Verifies a Biscuit authorization token locally without contacting the authorization server.