Struct CapabilityToken 

pub struct CapabilityToken {
    pub version: u8,
    pub token_id: String,
    pub allowed_namespaces: Vec<String>,
    pub tenant_id: Option<String>,
    pub project_id: Option<String>,
    pub capabilities: TokenCapabilities,
    pub issued_at: u64,
    pub expires_at: u64,
    pub acl_tags: Vec<String>,
    pub signature: Vec<u8>,
}

A capability token that encodes access permissions

This is the serializable form that can be passed across API boundaries.

Fields

version: u8

Token version (for future upgrades)

token_id: String

Token ID (for revocation tracking)

allowed_namespaces: Vec<String>

Allowed namespaces (non-empty)

tenant_id: Option<String>

Optional tenant ID

project_id: Option<String>

Optional project ID

capabilities: TokenCapabilities

Capability flags

issued_at: u64

Issued at (Unix timestamp)

expires_at: u64

Expires at (Unix timestamp)

acl_tags: Vec<String>

ACL tags the token holder can access (for row-level ACLs)

signature: Vec<u8>

Signature (HMAC-SHA256 or Ed25519)

Implementations

impl CapabilityToken

pub const CURRENT_VERSION: u8 = 1

Current token version

pub fn is_expired(&self) -> bool

Check if the token is expired

pub fn is_namespace_allowed(&self, namespace: &str) -> bool

Check if a namespace is allowed

pub fn to_auth_scope(&self) -> AuthScope

Convert to AuthScope for use with FilterIR

pub fn remaining_validity(&self) -> Option<Duration>

Get remaining validity duration

Trait Implementations

impl Clone for CapabilityToken

fn clone(&self) -> CapabilityToken

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CapabilityToken

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CapabilityToken

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for CapabilityToken

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.