Struct CredentialMetadata 

pub struct CredentialMetadata {
    pub kind: CredentialKind,
    pub attach_as: AttachmentSite,
    pub scheme: Option<CredentialScheme>,
    pub scopes: Vec<Scope>,
    pub expires_at: Option<DateTime<Utc>>,
    pub refresh_via: Option<MethodPath>,
    pub revoke_via: Option<MethodPath>,
    pub issuer: CredentialIssuer,
    pub sensitive: bool,
}

What this credential is and how to attach it on subsequent calls.

Every metadata field is a typed newtype, never a bare string. The CredentialMetadata::sensitive field is always true; it exists on the struct so the metadata is the single source of truth for the redaction pipeline (AUTHZ-PRIVACY-1).

Metadata is fixed at mint time: a Credential<T> exposes its metadata via Credential::metadata, but there is no mutable accessor.

Fields

kind: CredentialKind

What kind of credential this is. Tags storage decisions and drives selection.

attach_as: AttachmentSite

Where the credential is attached on the wire when sent on subsequent calls.

scheme: Option<CredentialScheme>

Optional prefix prepended to the value at attach time (e.g., "Bearer " for Authorization: Bearer <token>). Stored in the metadata so the client doesn’t have to guess.

scopes: Vec<Scope>

Which scopes this credential authorizes. Empty set means “scope decision is server-side; client doesn’t filter.”

expires_at: Option<DateTime<Utc>>

Hard expiry of the credential value, if known at issue time. Used for proactive refresh and for dropping stale stored credentials.

refresh_via: Option<MethodPath>

Optional refresh hint: if this credential expires, call this method to obtain a fresh one. The named-session framework handles the swap; activation code is uninvolved.

revoke_via: Option<MethodPath>

Optional revocation hint: calling this method invalidates the credential server-side.

issuer: CredentialIssuer

Identity of the issuing party.

sensitive: bool

Sensitivity marker for the redaction pipeline (AUTHZ-PRIVACY-1). Always true; present for type-system uniformity so any code that reads the metadata has a single source of truth.

Implementations

impl CredentialMetadata

pub fn new( kind: CredentialKind, attach_as: AttachmentSite, scheme: Option<CredentialScheme>, scopes: Vec<Scope>, expires_at: Option<DateTime<Utc>>, refresh_via: Option<MethodPath>, revoke_via: Option<MethodPath>, issuer: CredentialIssuer, ) -> Self

Construct a fresh CredentialMetadata. The sensitive flag is always initialized to true; the field exists so callers reading metadata can treat it as the single source of truth without consulting outside state.

Public — the metadata is not a secret. The seal is on the credential VALUE, not on the metadata that describes it.

Trait Implementations

impl Clone for CredentialMetadata

fn clone(&self) -> CredentialMetadata

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CredentialMetadata

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CredentialMetadata

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for CredentialMetadata

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for CredentialMetadata

fn eq(&self, other: &CredentialMetadata) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for CredentialMetadata

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for CredentialMetadata

impl StructuralPartialEq for CredentialMetadata