Struct AuthenticatedPrincipal 

pub struct AuthenticatedPrincipal {
    pub principal: PrincipalId,
    pub grant: GrantToken,
    /* private fields */
}

The authenticated principal + the verified grant carried by a bearer token.

Produced by IjimaAuth::verify_bearer. Handlers consult may to enforce a specific capability. The grant’s partitions are cryptographically signed, so the geometric containment check needs only the shared controller (to resolve a required capability’s partition) and the shared verifier — both cheap Arc clones.

Fields

principal: PrincipalId

The principal this grant was issued to.

grant: GrantToken

The verified multi-capability grant.

Implementations

impl AuthenticatedPrincipal

pub fn may(&self, required: &str) -> bool

Returns true if the grant geometrically implies required (directly or because some granted partition λ satisfies required.partition ≤ λ component-wise).

An unknown required capability (not in the policy) is denied.

pub fn granted_capabilities(&self) -> Vec<String>

The list of capabilities explicitly carried by this grant (for debugging / operator visibility). Note this is the signed set, not the geometric closure — a grant of [memory:write] also implies memory:read via may even though read is not listed here.

pub fn personal_namespace(&self) -> NamespaceId

This principal’s default personal namespace id (ns_<principal>_private). Every request is scoped to this namespace unless explicit namespace parameters land later.

Trait Implementations

impl Clone for AuthenticatedPrincipal

fn clone(&self) -> AuthenticatedPrincipal

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuthenticatedPrincipal

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.