Struct TenantCapability 

pub struct TenantCapability { /* private fields */ }

Unforgeable proof of authority to mutate a single tenant’s quota counters.

Minted only by crate::TenantRegistry::register_with_capability; the _seal field is private to this crate so no downstream crate (and no hostile workload) can construct one out of thin air. Holding an Arc<TenantContext> is therefore no longer sufficient to drive that tenant’s bytes_in_use counter — the caller must also present the matching capability, which it can only get if it originally registered the tenant.

Clone is intentionally derived: the API gateway holds the authoritative copy and may need to hand clones to per-tenant subsystems (the scheduler, the memory pool, etc.). What is NOT derived is any From<TenantId> or public constructor, so a workload running inside tenant A cannot fabricate one for tenant B.

Registry binding (H1 — always enforced)

Every capability carries an Arc<()> token that points to its minting registry’s allocation. Comparison is by Arc::ptr_eq, so a capability minted by registry A is rejected when presented against a context registered in registry B, even if both contexts happen to share the same numeric TenantId. Without this binding, capabilities from independent registries are interchangeable, which the H1 audit finding flagged as a cross-registry capability-confusion vector — see the note on RegistryAdminCapability for the threat model.

H1 fix: this binding is now UNCONDITIONAL and no longer behind the strict-cap-binding feature gate. A release build with the feature disabled still binds caps to their minting registry and still fails closed on cross-registry / forged-admin caps. The strict-cap-binding feature remains defined only to keep the typed *_strict admin APIs and the cap_binding_strict integration test compiling.

Implementations

impl TenantCapability

pub fn tenant_id(&self) -> TenantId

Identifier of the tenant this capability authorises.

Trait Implementations

impl Clone for TenantCapability

fn clone(&self) -> TenantCapability

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TenantCapability

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.