Struct Validator 

pub struct Validator<'a> { /* private fields */ }

Prepared validator with mandatory audience/purpose and optional exact capabilities.

Implementations

impl Validator<'_>

pub fn validate( &self, token: &str, now: u64, hook: &dyn ValidationHook, ) -> Result<Arc<Principal>>

pub fn validate_cached( &self, token: &str, now: u64, cache: &dyn PrincipalCache, ttl: Duration, hook: &dyn ValidationHook, ) -> Result<Arc<Principal>>

No token decryption, base64 or claims decoding on a warm cache hit. Hooks still consult current policy; FleetAuth checks its authenticated shared state.

TTL is caller-owned and never exceeds token expiry. Zero/subsecond TTL disables caching. Static checks and the hook run every time. Callers supply current Unix seconds from a trusted clock, never from client input.

pub fn cache_key(&self, token: &str) -> Result<CacheKey>

Fingerprint calculation does not authenticate the token or expose its claims.