Module capability_token 

Capability Tokens + ACLs (Task 8)

This module implements staged ACLs via capability tokens for the local-first architecture. The design prioritizes:

1. Simplicity - Easy to reason about, hard to misapply
2. Local-first - No external auth service required
3. Composability - ACLs integrate with existing filter infrastructure

Token Structure

CapabilityToken {
    allowed_namespaces: ["prod", "staging"],
    tenant_id: Option<"acme_corp">,
    project_id: Option<"project_123">,
    capabilities: { read: true, write: false, ... },
    expires_at: 1735689600,
    signature: HMAC-SHA256(...)
}

Verification

Token verification is O(1):

• HMAC-SHA256 for symmetric tokens
• Ed25519 for asymmetric tokens (cached verification)

Row-Level ACLs (Future)

Row-level ACL tags become “just another metadata atom”:

HasTag(acl_tag) → bitmap lookup → AllowedSet intersection

This composes cleanly with existing filter infrastructure.

Structs

AclTag

A row-level ACL tag

AclTagIndex

ACL tag index for row-level security

CapabilityToken

A capability token that encodes access permissions

RevocationList

Simple in-memory token revocation list

TokenBuilder

Builder for creating capability tokens

TokenCapabilities

Capability flags in the token

TokenSigner

Token signer using HMAC-SHA256

TokenValidator

Complete token validator

Enums

TokenError

Token errors