Struct IjimaAuth 

pub struct IjimaAuth { /* private fields */ }

Ijima’s auth core: an AccessController (capability → partition resolver) plus a capability issuer and a grant verifier sharing one Ed25519 key, and an in-memory revocation set (the grant kill-switch — see docs/adr/token-revocation.md).

A daemon constructs one of these at startup, hydrates the revocation set from the store (hydrate_revocations), and serves; an admin CLI uses the issuer to mint grant tokens via IjimaAuth::issue_grant_bearer.

Implementations

impl IjimaAuth

pub fn from_embedded_policy() -> Result<Self>

Loads the embedded policy/policy.toml and generates a fresh Ed25519 issuer key pair.

Use only for tests/ephemeral runs — every call produces a new key, so issued tokens will not verify against a different instance. For a persistent daemon/CLI, use from_embedded_policy_with_seed with a seed from key_store.

Errors

Returns IjimaError::InvalidInput if the policy TOML is invalid.

pub fn from_embedded_policy_with_seed(seed: [u8; 32]) -> Result<Self>

Loads the embedded policy and constructs the issuer from a known 32-byte Ed25519 seed. The same seed must be shared by every process that issues or verifies tokens for this Ijima instance.

Errors

Returns IjimaError::InvalidInput if the policy TOML is invalid.

pub fn generate_seed() -> [u8; 32]

Generates a fresh random 32-byte issuer seed (for first-time setup).

Delegates to KeyStore::generate_seed.

pub fn issuer_public_key_hex(&self) -> String

The issuer’s Ed25519 public key as lowercase hex, for distribution to verifiers and operator visibility.

pub fn grassmannian(&self) -> (usize, usize)

Returns the Grassmannian the controller operates on.

pub fn issue_grant_bearer( &self, principal: impl Into<PrincipalId>, capabilities: &[&str], ) -> Result<String>

Issues a multi-capability grant token (base64 wire format) granting every capability in capabilities to principal.

Each capability’s partition is resolved from the embedded policy; an unknown capability is rejected. Singleton grants are issued with issue_bearer.

Errors

Returns IjimaError::InvalidInput if a capability is unknown to the policy, the grant is empty, or Schubert’s issuer rejects the inputs.

pub fn issue_grant_bearer_with_expiry( &self, principal: impl Into<PrincipalId>, capabilities: &[&str], expires_at_unix: u64, ) -> Result<String>

Issues a grant that dies at expires_at_unix (Unix seconds, Schubert 0.5 ADR-0001: the boundary is inclusive — the grant is dead the instant now >= expires_at). Expiry is covered by the signature and enforced by GrantVerifier::verify standalone; expired bearers fail verify_bearer with an expired detail.

Errors

Returns IjimaError::InvalidInput on unknown capabilities or issuer rejection — same contract as issue_grant_bearer.

pub fn issue_grant_bearer_under_policy( &self, principal: impl Into<PrincipalId>, capabilities: &[&str], policy: &GrantPolicy, expires_at: Option<u64>, ) -> Result<String>

Policy-constrained issuance (Schubert 0.5 #20.3): signs only what policy entitles this principal to carry. Fails closed — an unknown principal or a capability outside the entitlement denies with schubert::SchubertError::GrantDeniedByPolicy detail (no smuggling a stronger geometry under an allowed id). expires_at passes through to the issuer (None = never, pre-0.5 behavior).

This is the seam ijima token issue builds on; the unconstrained issue_grant_bearer remains for test tooling and trusted offline flows.

Errors

Returns IjimaError::InvalidInput when the policy denies the request, or for unknown capabilities.

pub fn grant_verifier(&self) -> &GrantVerifier

The grant verifier (exposes verify_at for clock-injected checks).

pub fn resolve_issuance_policy(explicit: Option<&Path>) -> Result<String>

Resolves the issuance policy for ijima token issue (Schubert 0.5 #20.3): an explicit --policy path wins (unreadable = hard error — an explicit pointer must be honored); then $IJIMA_POLICY (same hard-error rule); then $IJIMA_DIR/policy.toml if present; otherwise the embedded default (which seeds no principals — a fresh install mints nothing until the operator provisions a policy file).

Errors

Returns IjimaError::InvalidInput when an explicit/env policy path cannot be read or the fallback resolution fails.

pub fn issuance_policy_from_source(toml_str: &str) -> Result<PolicyConfig>

Builds the schubert::policy::PolicyConfig that constrains issuance from a resolved policy source. Two shapes are accepted:

• Full policy (contains [capabilities]): parsed and validated as a complete policy. Must match the embedded partition map the daemon verifies with — a diverging geometry is an operator error, surfaced as a hard parse error.
• Principals-only overlay (the operator-friendly default): [principals.<name>] grants = [...] sections merged onto the embedded policy. Partitions always derive from the embedded policy, so an overlay can only assign existing capabilities — never redefine the geometry (the #20.3 anti-smuggling invariant). The overlay’s principal map is authoritative: removing a principal removes their issuance entitlement (already-issued grants keep verifying — they are proof-carrying — until expiry or revocation).

Errors

Returns IjimaError::InvalidInput when neither shape parses, an overlay carries non-principal sections, or the merged config fails validation.

pub fn issue_bearer( &self, principal: impl Into<PrincipalId>, capability: impl AsRef<str>, ) -> Result<String>

Convenience: issues a single-capability grant. Equivalent to issue_grant_bearer with one entry.

Errors

Returns IjimaError::InvalidInput if the capability is unknown or Schubert’s issuer rejects the inputs.

pub fn hydrate_revocations(&self, revocations: &[TokenRevocation])

Hydrates the in-memory revocation set from store-backed records (daemon boot). Replaces any prior set.

pub fn revoke(&self, hash: &str)

Adds a revocation to the in-memory set (after the store write — the admin route persists first, then calls this). Idempotent.

pub fn is_revoked(&self, bearer: &str) -> bool

True if the bearer’s hash is revoked.

pub fn verify_bearer(&self, bearer: &str) -> Result<AuthenticatedPrincipal>

Decodes + cryptographically verifies a bearer grant token, returning the authenticated principal and the verified grant. A revoked bearer is rejected here — exactly as dead as a bad signature.

Errors

Returns IjimaError::InvalidInput on a malformed, bad-signature, or revoked token.

pub fn require( &self, bearer: &str, required: &str, ) -> Result<AuthenticatedPrincipal>

Convenience guard for handlers: verifies the token (authn) and authorizes via geometric containment — succeeds when the grant implies required (see AuthenticatedPrincipal::may).

Errors

Returns an error if the token is invalid or does not imply required.

Trait Implementations

impl Debug for IjimaAuth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.