Function validate_token_against_file 

pub fn validate_token_against_file(
    presented_token: &str,
    token_path: &Path,
) -> Option<CallerRole>

Validate presented_token against the token stored in token_path.

Returns the role the token holder is granted (read from the SYSKNIFE_TOKEN_ROLE env var, defaulting to Dev) on success, or None if the token file is absent, unreadable, or the token does not match.

Whitespace (including trailing newlines) is stripped from the stored token before comparison. Provision the file with install -m 600 — a token file readable by group or other is rejected outright (see below).

Permissions

The file must not be group- or world-accessible (mode & 0o077 == 0), mirroring the check AuditKey::load_or_generate applies to the Ed25519 signing key. Without it, a token written under a default umask 022 lands at 0644, and any local user who can read it can authenticate over vsock and receive token_role() — bypassing the SO_PEERCRED → group → CallerRole mechanism that is the documented authorization model for the Unix path.