Crate hessra_token

Hessra Token

Core verification library for Hessra authentication tokens.

This crate provides functionality for creating, verifying and attenuating biscuit tokens used in the Hessra authentication system. It is designed to be WASM-compatible and has no networking dependencies.

Features

• Token creation: Create new tokens with configurable time settings
• Token verification: Verify tokens without contacting the authorization server
• Token attestation: Add service node attestations to tokens
• WASM compatibility: Can be compiled to WebAssembly for use in browsers

Usage

use hessra_token::{create_biscuit, verify_token_local, biscuit_key_from_string, TokenTimeConfig, KeyPair, encode_token};

fn main() -> Result<(), hessra_token::TokenError> {
    // Create a new token
    let keypair = KeyPair::new();
    let token = create_biscuit(
        "user123".to_string(),
        "resource456".to_string(),
        keypair,
        TokenTimeConfig::default(),
    ).map_err(|e| hessra_token::TokenError::generic(e.to_string()))?;
     
    // Verify the token
    let token_string = encode_token(&token);
    let public_key = biscuit_key_from_string("ed25519/01234567890abcdef".to_string())?;
    verify_token_local(&token_string, public_key, "user123", "resource456")?;
     
    println!("Token creation and verification successful!");
    Ok(())
}

Structs

Biscuit

This structure represents a valid Biscuit token

ServiceNode

TokenTimeConfig

TokenTimeConfig allows control over token creation times and durations This is used to create tokens with custom start times and durations for testing purposes. In the future, this can be enhanced to support variable length tokens, such as long-lived bearer tokens.

Enums

KeyPair

pair of cryptographic keys used to sign a token’s block

PublicKey

the public part of a KeyPair

TokenError

Error type for hessra-token operations

Functions

add_service_node_attenuation

Add a service node attestation to a token

biscuit_key_from_string

Takes a public key encoded as a string in the format “ed25519/…” or “secp256r1/…” and returns a PublicKey.

create_biscuit

Creates a new biscuit token with the specified subject and resource.

create_service_chain_biscuit

Creates a new biscuit token with service chain attestations. Creates a new biscuit token with service chain attestations.

create_service_chain_token

create_service_chain_token_with_time

create_token

create_token_with_time

decode_token

Decode a URL-safe base64 encoded token string to binary

encode_token

Encode binary token data to URL-safe base64 string

parse_token

Extracts and parses a Biscuit token from a URL-safe base64 string

public_key_from_pem_file

verify_biscuit_local

Verifies a Biscuit authorization token locally without contacting the authorization server.

verify_service_chain_biscuit_local

verify_service_chain_token_local

verify_token_local

Verifies a Biscuit authorization token locally without contacting the authorization server.