Skip to main content

TokenMinter

microvms_core::session::proxy

Trait TokenMinter 

Source 
pub trait TokenMinter: Send + Sync {
    // Required method
    fn mint(
        &self,
    ) -> Pin<Box<dyn Future<Output = Result<ProxyToken, Error>> + Send + '_>>;

    // Provided method
    fn mint_for_ports(
        &self,
        ports: &[u16],
    ) -> Pin<Box<dyn Future<Output = Result<ProxyToken, Error>> + Send + '_>> { ... }
}
Expand description

Mints a proxy token. One method, so a test needs no AWS.

Narrow on purpose: the control plane’s mint_auth_token implements this and nothing else about the control plane is reachable from a session. A Session coupled to the whole control-plane client would be a session that cannot be built without credentials, and the conformance path talks to a local daemon.

Boxed future rather than async fn in the trait: a Session holds Arc<dyn TokenMinter>, and an async fn in a trait is not dyn-compatible.

Required Methods§

Source

fn mint( &self, ) -> Pin<Box<dyn Future<Output = Result<ProxyToken, Error>> + Send + '_>>

Mints a token for the session’s own port. The hot path.

Provided Methods§

Source

fn mint_for_ports( &self, ports: &[u16], ) -> Pin<Box<dyn Future<Output = Result<ProxyToken, Error>> + Send + '_>>

Mints a token that also authorizes ports.

Separate from Self::mint rather than replacing it, because the two answer different questions and the common one must stay free of a list nobody populates: every request this client makes on its own behalf targets the agent port, and that is what mint is for.

This exists because the scope was the defect. Session::connect_headers(port) and connect_subprotocols(port) were built over mint’s token, which the control plane scopes to the agent port alone — so they answered a correct-looking port header behind a credential that did not authorize it. Measured 2026-08-15: GET :8080 through the endpoint is 403 Access to port denied under that token and 200 under one minted with 8080 in allowedPorts, and on the WebSocket path the same rejection is close code 1006 with no reason. See crate::control::ops::PortSpecification for the table.

The default implementation ignores ports and delegates, which is honest for the two kinds of minter that have no control plane behind them — a test double, or a session against a daemon reached directly, where there is no proxy to authorize anything. A minter that can widen a scope overrides it, and the one in sandbox.rs does.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§