Function verify_token

pub fn verify_token(
    token_string: &str,
    public_key: PublicKey,
    subject: &str,
    resource: &str,
) -> Result<(), TokenError>

Verify a base64-encoded token string

This is a convenience function that decodes the token string and calls verify_biscuit_local

Arguments

• token_string - Base64 encoded token string
• public_key - The public key used to verify the token signature
• subject - The subject (user) identifier to verify authorization for
• resource - The resource identifier to verify authorization against

Returns

• Ok(()) - If the token is valid and grants access to the resource
• Err(TokenError) - If verification fails for any reason

Examples found in repository

examples/token_attenuation.rs (lines 32-37)

fn main() -> Result<(), TokenError> {
    // Generate an example token
    let (token_base64, root_keypair) = generate_example_token()?;
    println!("Original token: {}\n", token_base64);

    // Create a service node keypair
    let service_keypair = KeyPair::new();

    // 1. First, we need the binary token data
    let token_bytes = decode_token(&token_base64)?;

    // 2. Add service node attenuation
    println!("Adding service node attenuation...");
    let attenuated_token = add_service_node_attenuation(
        token_bytes,
        root_keypair.public(),
        "my-service",
        &service_keypair,
    )?;

    // 3. Encode back to base64
    let attenuated_token_base64 = encode_token(&attenuated_token);
    println!("Attenuated token: {}\n", attenuated_token_base64);

    // 4. Verify the attenuated token still works
    println!("Verifying attenuated token...");
    verify_token(
        &attenuated_token_base64,
        root_keypair.public(),
        "alice",
        "resource1",
    )?;
    println!("✅ Verification successful for attenuated token");

    // 5. Generate a chain of attenuations
    println!("\nCreating a chain of attenuations...");
    let token_with_chain = create_attenuation_chain(&token_base64, &root_keypair)?;
    println!("Token with attenuation chain: {}", token_with_chain);

    // 6. Verify the chain token
    println!("\nVerifying token with attenuation chain...");
    verify_token(
        &token_with_chain,
        root_keypair.public(),
        "alice",
        "resource1",
    )?;
    println!("✅ Verification successful for token with attenuation chain");

    Ok(())
}

examples/token_verification.rs (line 15)

fn main() -> Result<(), TokenError> {
    // Generate an example token
    let root_keypair = Arc::new(KeyPair::new());
    let token_base64 = generate_example_token(root_keypair.clone())?;
    println!("Generated token: {}\n", token_base64);

    // Example 1: Basic verification
    println!("Example 1: Basic verification");
    verify_token(&token_base64, root_keypair.public(), "alice", "resource1")?;
    println!("✅ Basic verification successful\n");

    // Example 2: Service chain verification
    println!("Example 2: Service chain verification");

    // Create service node keypairs
    let service1_keypair = KeyPair::new();
    let service1_pk_hex = hex::encode(service1_keypair.public().to_bytes());
    let service1_public_key = format!("ed25519/{}", service1_pk_hex);

    let service2_keypair = KeyPair::new();
    let service2_pk_hex = hex::encode(service2_keypair.public().to_bytes());
    let service2_public_key = format!("ed25519/{}", service2_pk_hex);

    // Define service nodes
    let service_nodes = vec![
        ServiceNode {
            component: "node1".to_string(),
            public_key: service1_public_key.clone(),
        },
        ServiceNode {
            component: "node2".to_string(),
            public_key: service2_public_key.clone(),
        },
    ];

    // Generate a token with service chain
    let chain_token = generate_service_chain_token(
        root_keypair.clone(),
        service1_public_key,
        service2_public_key,
    )?;

    // attenuate the token for node1
    let attenuated_token = add_service_node_attenuation(
        decode_token(&chain_token)?,
        root_keypair.public(),
        "resource1",
        &service1_keypair,
    )?;

    // attenuate the token for node2
    let attenuated_token2 = add_service_node_attenuation(
        attenuated_token,
        root_keypair.public(),
        "resource1",
        &service2_keypair,
    )?;

    // Verify with service chain
    verify_service_chain_token(
        &encode_token(&attenuated_token2),
        root_keypair.public(),
        "alice",
        "resource1",
        service_nodes,
        None,
    )?;
    println!("✅ Service chain verification successful\n");

    // Example 3: Verification with key from string
    println!("Example 3: Verification with key from string");

    // Convert public key to string format and back
    let pk_hex = hex::encode(root_keypair.public().to_bytes());
    let pk_str = format!("ed25519/{}", pk_hex);
    let parsed_pk = biscuit_key_from_string(pk_str)?;

    // Verify with parsed key
    verify_token(&token_base64, parsed_pk, "alice", "resource1")?;
    println!("✅ Verification with key from string successful");

    Ok(())
}