Struct HmacTokenGenerator 

pub struct HmacTokenGenerator { /* private fields */ }

HMAC-based token generator for MVP.

Implementations

impl HmacTokenGenerator

pub const MIN_SECRET_LEN: usize = 16

Minimum secret length in bytes for HMAC token generation.

Secrets shorter than this are rejected to prevent trivially forgeable tokens. 16 bytes (128 bits) is the minimum recommended for HMAC-SHA256.

pub fn new(secret: TokenSecret) -> Result<Self, TokenError>

Create a new HMAC token generator with a TokenSecret.

Errors

Returns TokenError::SecretTooShort if the secret is shorter than Self::MIN_SECRET_LEN (16 bytes).

pub fn new_from_bytes(bytes: impl Into<Vec<u8>>) -> Result<Self, TokenError>

Create from raw bytes (backward-compatible migration helper).

Wraps the bytes in a TokenSecret internally. Prefer constructing a TokenSecret directly for new code.

Errors

Returns TokenError::SecretTooShort if the secret is shorter than Self::MIN_SECRET_LEN (16 bytes).

pub fn from_env(env_var: &str) -> Result<Self, Box<dyn Error>>

Create from an environment variable.

Errors

Returns an error if the environment variable is not set or if the secret is shorter than Self::MIN_SECRET_LEN (16 bytes).

Trait Implementations

impl TokenGenerator for HmacTokenGenerator

fn generate( &self, code: &str, user_id: &str, session_id: &str, server_id: &str, context_hash: &str, risk_level: RiskLevel, ttl_seconds: i64, ) -> ApprovalToken

Generate a signed approval token.

fn verify(&self, token: &ApprovalToken) -> Result<(), ExecutionError>

Verify a token and return Ok if valid.

fn verify_code( &self, code: &str, token: &ApprovalToken, ) -> Result<(), ExecutionError>

Verify that submitted code matches the token’s code hash.