Struct Validator 

pub struct Validator<'a> { /* private fields */ }

Prepared validator with mandatory audience/purpose and optional exact capabilities.

Implementations

impl Validator<'_>

pub fn into_owned(self) -> OwnedValidator

Take ownership of the realm/issuer labels and move the prepared policy and derived keys unchanged. No key derivation or cache namespace change occurs. The result may outlive the Authority and be stored in a long-lived service. Like any prepared validator, it retains its trust snapshot until replaced.

pub fn validate( &self, token: &str, now: u64, hook: &dyn ValidationHook, ) -> Result<Arc<Principal>>

pub fn validate_lapsed( &self, token: &str, now: u64, hook: &dyn ValidationHook, ) -> Result<Arc<Principal>>

A credential past its own expiry whose session may still be live: the envelope is authenticated and every check but the credential’s expiry runs, then the hook decides from the shared state (a revoked or expired session still refuses). For reissuing a carrier whose session outlived it, never for admitting work on the lapsed credential itself. Not cached: a lapsed credential is answered once, with a new one.

pub fn validate_cached( &self, token: &str, now: u64, cache: &dyn PrincipalCache, ttl: Duration, hook: &dyn ValidationHook, ) -> Result<Arc<Principal>>

No token decryption, base64 or claims decoding on a warm cache hit. Hooks still consult current policy; FleetAuth checks its authenticated shared state.

TTL is caller-owned and never exceeds token expiry. Zero/subsecond TTL disables caching. Static checks and the hook run every time. Callers supply current Unix seconds from a trusted clock, never from client input.

pub fn cache_key(&self, token: &str) -> Result<CacheKey>

Fingerprint calculation does not authenticate the token or expose its claims.