Expand description
Minimal verifiable capability (lease) — the seed of #126 (capability-leased access).
A Capability binds a principal to a scope with an optional expiry and
is HMAC-signed by an issuer key, so a capability id recorded in write
provenance can be verified against the key rather than trusted as a
free-form string. The write path (REMEMBER / SHARE) verifies a presented
capability before recording it in crate::model::write_provenance.
This is deliberately small: it is the authorisation token, not a policy
engine. Enforcing what a scope permits (namespace / op gating) is the
follow-up tracked in #126. Today the token proves exactly one thing:
“principal P held a valid, unexpired, issuer-signed capability with scope
S.” That is enough to make a write’s authority a real, checkable fact
instead of a recorded label.
Structs§
- Capability
- A signed, time-bounded authorisation token.
- Capability
Issuer - Issues and verifies
Capabilitytokens against a single HMAC key.