Crate aura_authorization 

Aura Web of Trust - Layer 2: Specification (Domain Crate)

Purpose: Define trust and authorization semantics with capability refinement.

Authority-based authorization system using Biscuit tokens for cryptographically verifiable capability delegation. This crate implements the Web of Trust layer from Aura’s architectural model, providing Biscuit-based authorization with authority-centric resource scopes.

Architecture Constraints

Layer 2 depends only on aura-core (foundation).

• ✓ Capability refinement logic (meet-semilattice ⊓)
• ✓ Biscuit token helpers and semantics (no cryptographic operations)
• ✓ Authorization domain types and policies
• ✗ NO cryptographic signing (that’s aura-effects via CryptoEffects)
• ✗ NO handler composition (that’s aura-composition)
• ✗ NO multi-party protocol logic (that’s aura-protocol)

Authorization System

The crate provides:

• Biscuit token model and verification semantics
• Authority-centric resource scopes (AuthorityOp, ContextOp)
• Capability refinement with attenuation rules
• Policy evaluation patterns (datalog-based)

Usage

use aura_authorization::{ResourceScope, AuthorityOp};
use aura_core::{AuthorityId};

// Authority-based resource authorization
let resource = ResourceScope::Authority {
    authority_id: AuthorityId::new_from_entropy([1u8; 32]),
    operation: AuthorityOp::UpdateTree,
};
// Token verification handles cryptographic delegation chains

Re-exports

pub use errors::WotError;

pub use errors::WotResult;

pub use effects::WotAuthorizationHandler;

pub use biscuit_token::BiscuitError;

pub use biscuit_token::BiscuitTokenManager;

pub use biscuit_token::SerializableBiscuit;

pub use biscuit_token::TokenAuthority;

pub use biscuit_token::TokenGrantProfile;

pub use flow_budget::JournalBackedFlowBudgetHandler;

pub use facts::WotFact;

pub use facts::WotFactDelta;

pub use facts::WotFactReducer;

pub use facts::WOT_FACT_TYPE_ID;

pub use biscuit_authorization::AuthorizationResult;

pub use biscuit_authorization::BiscuitAuthorizationBridge;

pub use storage_authorization::check_biscuit_access;

pub use storage_authorization::evaluate_biscuit_access;

pub use storage_authorization::AccessDecision;

pub use storage_authorization::AuthorizedStorageHandler;

pub use storage_authorization::BiscuitAccessRequest;

pub use storage_authorization::BiscuitStorageError;

pub use storage_authorization::BiscuitStorageEvaluator;

pub use storage_authorization::PermissionMappings;

pub use storage_authorization::StoragePermission;

pub use storage_authorization::StorageResource;

pub use effect_policy::ApprovalThreshold;

pub use effect_policy::CapabilityRequirement;

pub use effect_policy::CeremonyType;

pub use effect_policy::EffectDecision;

pub use effect_policy::EffectPolicy;

pub use effect_policy::EffectPolicyRegistry;

pub use effect_policy::EffectTiming;

pub use effect_policy::OperationType;

pub use effect_policy::SecurityLevel;

pub use proposals::ProposalFact;

pub use proposals::ProposalFactDelta;

pub use proposals::ProposalFactReducer;

pub use proposals::ProposalFailureReason;

pub use proposals::ProposalState;

pub use proposals::ProposalStatus;

pub use proposals::PROPOSAL_FACT_TYPE_ID;

Modules

biscuit_authorization

Layer 2: Biscuit Cryptographic Authorization

biscuit_token

Biscuit token authority and management for capability-based authorization.

capabilities

Typed capability families shared across authorization policy surfaces.

effect_policy

Effect Policy Infrastructure

effects

Authorization Effects Implementation - Web-of-Trust Domain Logic

errors

Web of Trust error handling using unified error macros.

facts

Web of Trust Domain Facts

flow_budget

Journal-backed flow budget handler.

proposals

Proposal facts for deferred operations

resource_scope

Authority-based resource scopes for authorization

storage_authorization

Storage-specific authorization logic using Biscuit tokens

Structs

Biscuit

This structure represents a valid Biscuit token

KeyPair

pair of cryptographic keys used to sign a token’s block

PublicKey

the public part of a KeyPair

Enums

AuthorityOp

Operations that can be performed on an authority

ContextOp

Operations within a relational context

ResourceScope

Resource scope for authority-based authorization

Traits

MeetSemiLattice

Meet semi-lattice with greatest lower bound operation

Top

Top element for meet semi-lattices (most permissive state)

Type Aliases

CapResult

Type alias for capability meet operation results