Crate hessra_token

Hessra Token

Core verification library for Hessra authentication tokens.

This crate provides functionality for verifying and attenuating biscuit tokens used in the Hessra authentication system. It is designed to be WASM-compatible and has no networking dependencies.

Features

• Token verification: Verify tokens without contacting the authorization server
• Token attestation: Add service node attestations to tokens
• WASM compatibility: Can be compiled to WebAssembly for use in browsers

Usage

use hessra_token::{verify_token, biscuit_key_from_string};

fn main() -> Result<(), hessra_token::TokenError> {
    let token_base64 = "YOUR_TOKEN_STRING";
     
    // Parse public key from string format
    let public_key = biscuit_key_from_string("ed25519/01234567890abcdef".to_string())?;
     
    // Verify the token
    verify_token(token_base64, public_key, "user123", "resource456")?;
     
    println!("Token verification successful!");
    Ok(())
}

Structs

Biscuit

This structure represents a valid Biscuit token

ServiceNode

Enums

KeyPair

pair of cryptographic keys used to sign a token’s block

PublicKey

the public part of a KeyPair

TokenError

Error type for hessra-token operations

Functions

add_service_node_attenuation

Add a service node attestation to a token

biscuit_key_from_string

Takes a public key encoded as a string in the format “ed25519/…” or “secp256r1/…” and returns a PublicKey.

decode_token

Decode a base64 encoded token string to binary

encode_token

Encode binary token data to base64 string

parse_token

Extracts and parses a Biscuit token from a base64 string

public_key_from_pem_file

verify_biscuit_local

Verifies a Biscuit authorization token locally without contacting the authorization server.

verify_service_chain_biscuit_local

verify_service_chain_token

Verify a base64-encoded token string with service chain validation

verify_token

Verify a base64-encoded token string