Crate spacedb_access 

spacedb-access — SpaceDB Layer 5 (identity & access)

The consent layer, and the AI-age differentiator: inaccessible by default, accessible by mID-gated consent. Every read / write / compute is authorized by a signed, scoped, expiring, (S2) revocable Capability issued by an owner’s identity to a bearer — a human or an AI agent with its own identity.

M5-S1 ships the core: Identity (ECDSA P-256 / ES256), the Capability + SignedCapability model, the KeyDirectory seam (DID → published key), and authorize — the single chokepoint enforcing signature · bearer · scope · ops · expiry. Revocation + delegation (S2) and the audit log + human-vs-AI policy (S3) build on this.

Open-core (MIT): no MATA dependency. Identities are P-256 keys behind the KeyDirectory seam; MATA resolves did:mata via IAMHUMAN, a self-hoster uses MemKeyDirectory. ES256 matches mID, so MATA’s real mIDs verify identically.

Structs

AccessPolicy

Who reads freely, and whether agents must chain to an accountable identity.

AccessRequest

A request to access something, presented by a bearer.

AuditEntry

One immutable, signed entry in the access log.

AuditLog

A node’s append-only access log.

Capability

A grant of access from an issuer to a bearer.

CapabilityChain

A root capability plus a sequence of sub-grants, each signed by the previous bearer.

Did

An identity reference: who an issuer/bearer is. Resolved to a key via the directory.

Identity

A P-256 keypair bound to a Did. Signs capabilities and sub-grants; its public key is published to a directory for verifiers.

MemKeyDirectory

In-memory DID → key directory, for tests and single-machine use.

Ops

The operations a capability grants — a bitset of read / write / compute.

RevocationSet

The set of revoked capability ids known to a node.

SignedCapability

A capability plus the issuer’s signature over its canonical bytes.

Enums

AccessError

AuditDecision

What was decided, recorded for the audit trail.

AuditError

Decision

The authorization decision.

DelegationError

Why a delegation link was invalid.

DenyReason

Why an access was denied.

Scope

What a capability applies to.

Traits

KeyDirectory

Resolves a Did to its published SEC1 verification key.

Functions

authorize

Authorize request against a single (root) capability.

authorize_chain

Authorize request against a delegation chain: verify every link’s signature, that each link narrows its parent, that no link is revoked, and that the leaf satisfies the request.

delegate

Extend parent by delegating sub, signed by delegator. The narrowing and depth constraints are enforced at authorization time (authorize_chain); this just signs and appends, so callers should build sub with issuer = delegator.did() and a scope/ops/ expiry within the parent.

gate

Decide an access under policy + capabilities.

Type Aliases

AccessResult

AuditResult