Struct GrantSeat 

pub struct GrantSeat { /* private fields */ }

A host-only capability-grant seat: the authority to grant a capability into a Cx.

A GrantSeat is minted ONLY when a context is constructed (Cx::new_seated) or, under the test-support feature, by GrantSeat::for_test. It has no public constructor otherwise, so it cannot be forged. Crucially, it is never passed into Callable::call – a loaded callable receives a &mut Cx but no seat, so it cannot grant itself a capability. Host code (a bootloader, a server session, a loader) holds the seat and grants through it.

Implementations

impl GrantSeat

pub fn grant(&self, cx: &mut Cx, capability: CapabilityName)

Grants a capability into cx under this host authority.

A seat may only grant into the context it was minted with (Cx::new_seated). Minting a fresh (Cx, GrantSeat) pair yields a seat bound to the fresh context, so it cannot be used to escalate a different (e.g. the caller’s own) context – this is what keeps a loaded callable from granting itself a capability.

pub fn grant_named(&self, cx: &mut Cx, capability: &'static str)

Grants a capability named by a static string into cx.

Trait Implementations

impl Debug for GrantSeat

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.