Struct SessionTokenAuthority 

pub struct SessionTokenAuthority { /* private fields */ }

Mints, rotates, and validates the composite broker_token ‖ daemon_token pair described in the module docs.

Implementations

impl SessionTokenAuthority

pub fn new() -> Result<Self, SessionTokenError>

Mint a fresh broker token from OS randomness. Call once at broker startup.

pub fn with_broker_token(broker_token: TokenHalf) -> Self

Test/deterministic constructor — production code should use Self::new so the broker half comes from real randomness.

pub fn broker_token(&self) -> &TokenHalf

The current broker-half bytes, for a caller (e.g. the front door spawning this broker) to hand to a newly-connecting client alongside the daemon half.

pub fn rotate_broker_token(&mut self) -> Result<TokenHalf, SessionTokenError>

Rotate the broker token in place — the live-rotation path (e.g. the spawn-storm guard tripping). Every previously-issued composite token stops validating immediately: Self::validate compares against the NEW value from the moment this returns.

pub fn register_daemon( &mut self, daemon_id: DaemonId, ) -> Result<TokenHalf, SessionTokenError>

Register (or re-register) a daemon’s token, minted fresh from OS randomness. Call once at that daemon’s startup.

pub fn invalidate_daemon(&mut self, daemon_id: &str) -> bool

Remove a daemon’s token entirely — every session naming this daemon_id fails Self::validate with SessionTokenRejection::DaemonUnknown from this call onward. Sessions naming any other daemon_id are unaffected. Returns whether a token was actually present.

pub fn daemon_count(&self) -> usize

How many daemons currently hold a registered token.

pub fn composed_token_for(&self, daemon_id: &str) -> Option<Vec<u8>>

The current composite broker_token ‖ daemon_token bytes for daemon_id, or None if it has no registered token (never registered, or already invalidated) – e.g. for a control-channel RPC handing the client something to present in a later Hello.

pub fn validate( &self, presented: &[u8], daemon_id: &str, ) -> Result<(), SessionTokenRejection>

Validate a presented composite token against a claimed daemon_id (which daemon the client’s Hello says it wants — see “Not done yet” for how that claim reaches here from the wire).

presented is broker_half ‖ daemon_half, SESSION_TOKEN_TOTAL_BYTES long. Checks the broker half FIRST and independently of daemon lookup, so a broker cycle reports as SessionTokenRejection::BrokerHalfMismatch even when the named daemon_id is also gone — the broker-wide event is the more global (and more actionable) verdict, and per-daemon state after a broker cycle is stale by definition, so reporting it would mislead the client about what happened.

Trait Implementations

impl Debug for SessionTokenAuthority

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.