Function encode_token

pub fn encode_token(token_bytes: &[u8]) -> String

Encode binary token data to base64 string

Arguments

• token_bytes - Binary token data

Returns

Base64 encoded token string

Examples found in repository

examples/token_attenuation.rs (line 27)

fn main() -> Result<(), TokenError> {
    // Generate an example token
    let (token_base64, root_keypair) = generate_example_token()?;
    println!("Original token: {}\n", token_base64);

    // Create a service node keypair
    let service_keypair = KeyPair::new();

    // 1. First, we need the binary token data
    let token_bytes = decode_token(&token_base64)?;

    // 2. Add service node attenuation
    println!("Adding service node attenuation...");
    let attenuated_token = add_service_node_attenuation(
        token_bytes,
        root_keypair.public(),
        "my-service",
        &service_keypair,
    )?;

    // 3. Encode back to base64
    let attenuated_token_base64 = encode_token(&attenuated_token);
    println!("Attenuated token: {}\n", attenuated_token_base64);

    // 4. Verify the attenuated token still works
    println!("Verifying attenuated token...");
    verify_token(
        &attenuated_token_base64,
        root_keypair.public(),
        "alice",
        "resource1",
    )?;
    println!("✅ Verification successful for attenuated token");

    // 5. Generate a chain of attenuations
    println!("\nCreating a chain of attenuations...");
    let token_with_chain = create_attenuation_chain(&token_base64, &root_keypair)?;
    println!("Token with attenuation chain: {}", token_with_chain);

    // 6. Verify the chain token
    println!("\nVerifying token with attenuation chain...");
    verify_token(
        &token_with_chain,
        root_keypair.public(),
        "alice",
        "resource1",
    )?;
    println!("✅ Verification successful for token with attenuation chain");

    Ok(())
}

/// Generate an example token for testing, returning both token and keypair
fn generate_example_token() -> Result<(String, KeyPair), TokenError> {
    // Create a test keypair
    let keypair = KeyPair::new();

    // Create a simple test biscuit with authorization rules
    let biscuit_builder = biscuit!(
        r#"
            // Grant rights to alice for resource1
            right("alice", "resource1", "read");
            right("alice", "resource1", "write");
        "#
    );

    // Build and serialize the token
    let biscuit = biscuit_builder
        .build(&keypair)
        .map_err(TokenError::biscuit_error)?;

    let token_bytes = biscuit.to_vec().map_err(TokenError::biscuit_error)?;

    // Encode to base64 for transmission
    Ok((encode_token(&token_bytes), keypair))
}

/// Create a chain of service attestations
fn create_attenuation_chain(
    token_base64: &str,
    root_keypair: &KeyPair,
) -> Result<String, TokenError> {
    // Decode the original token
    let mut token_bytes = decode_token(token_base64)?;

    // Create service keypairs
    let service_names = ["service-1", "service-2", "service-3"];

    // Add multiple service attestations
    for service_name in service_names.iter() {
        println!("  Adding attestation for {}", service_name);

        // Create a new keypair for this service
        let service_keypair = KeyPair::new();

        // Add an attestation
        token_bytes = add_service_node_attenuation(
            token_bytes,
            root_keypair.public(),
            service_name,
            &service_keypair,
        )?;
    }

    // Encode the final token
    Ok(encode_token(&token_bytes))
}

examples/token_verification.rs (line 67)

fn main() -> Result<(), TokenError> {
    // Generate an example token
    let root_keypair = Arc::new(KeyPair::new());
    let token_base64 = generate_example_token(root_keypair.clone())?;
    println!("Generated token: {}\n", token_base64);

    // Example 1: Basic verification
    println!("Example 1: Basic verification");
    verify_token(&token_base64, root_keypair.public(), "alice", "resource1")?;
    println!("✅ Basic verification successful\n");

    // Example 2: Service chain verification
    println!("Example 2: Service chain verification");

    // Create service node keypairs
    let service1_keypair = KeyPair::new();
    let service1_pk_hex = hex::encode(service1_keypair.public().to_bytes());
    let service1_public_key = format!("ed25519/{}", service1_pk_hex);

    let service2_keypair = KeyPair::new();
    let service2_pk_hex = hex::encode(service2_keypair.public().to_bytes());
    let service2_public_key = format!("ed25519/{}", service2_pk_hex);

    // Define service nodes
    let service_nodes = vec![
        ServiceNode {
            component: "node1".to_string(),
            public_key: service1_public_key.clone(),
        },
        ServiceNode {
            component: "node2".to_string(),
            public_key: service2_public_key.clone(),
        },
    ];

    // Generate a token with service chain
    let chain_token = generate_service_chain_token(
        root_keypair.clone(),
        service1_public_key,
        service2_public_key,
    )?;

    // attenuate the token for node1
    let attenuated_token = add_service_node_attenuation(
        decode_token(&chain_token)?,
        root_keypair.public(),
        "resource1",
        &service1_keypair,
    )?;

    // attenuate the token for node2
    let attenuated_token2 = add_service_node_attenuation(
        attenuated_token,
        root_keypair.public(),
        "resource1",
        &service2_keypair,
    )?;

    // Verify with service chain
    verify_service_chain_token(
        &encode_token(&attenuated_token2),
        root_keypair.public(),
        "alice",
        "resource1",
        service_nodes,
        None,
    )?;
    println!("✅ Service chain verification successful\n");

    // Example 3: Verification with key from string
    println!("Example 3: Verification with key from string");

    // Convert public key to string format and back
    let pk_hex = hex::encode(root_keypair.public().to_bytes());
    let pk_str = format!("ed25519/{}", pk_hex);
    let parsed_pk = biscuit_key_from_string(pk_str)?;

    // Verify with parsed key
    verify_token(&token_base64, parsed_pk, "alice", "resource1")?;
    println!("✅ Verification with key from string successful");

    Ok(())
}

/// Generate an example token for testing
fn generate_example_token(keypair: Arc<KeyPair>) -> Result<String, TokenError> {
    // Create a simple test biscuit with authorization rules
    let biscuit_builder = biscuit!(
        r#"
            // Grant rights to alice for resource1
            right("alice", "resource1", "read");
            right("alice", "resource1", "write");
        "#
    );

    // Build and serialize the token
    let biscuit = biscuit_builder
        .build(&keypair)
        .map_err(TokenError::biscuit_error)?;

    let token_bytes = biscuit.to_vec().map_err(TokenError::biscuit_error)?;

    // Encode to base64 for transmission
    Ok(encode_token(&token_bytes))
}

/// Generate a token with service chain attestations
fn generate_service_chain_token(
    root_keypair: Arc<KeyPair>,
    service1_public_key: String,
    service2_public_key: String,
) -> Result<String, TokenError> {
    // Create a biscuit with service chain authorization
    let biscuit_builder = biscuit!(
        r#"
            // Basic rights
            right("alice", "resource1", "read");
            right("alice", "resource1", "write");
            
            // Service nodes
            node($s, "node1") <- service($s) trusting authority, {node1_public_key};
            node($s, "node2") <- service($s) trusting authority, {node2_public_key};
        "#,
        node1_public_key = biscuit_key_from_string(service1_public_key)?,
        node2_public_key = biscuit_key_from_string(service2_public_key)?,
    );

    // Build and serialize the token
    let biscuit = biscuit_builder
        .build(&root_keypair)
        .map_err(TokenError::biscuit_error)?;

    let token_bytes = biscuit.to_vec().map_err(TokenError::biscuit_error)?;

    // Encode to base64
    Ok(encode_token(&token_bytes))
}