Struct Cursor 

pub struct Cursor {
    pub last_key: Vec<u8>,
    pub snapshot_id: u64,
}

Decoded cursor payload. Public so callers that want the raw last_key (e.g. for debugging or custom iteration) can inspect it. Never construct one directly off the wire — use Cursor::decode so the HMAC tag gets verified.

Fields

last_key: Vec<u8>

Raw fjall storage key of the last item the previous page returned. The next page begins strictly after this key.

snapshot_id: u64

Unix-second timestamp at the time of minting. Currently opaque metadata — see module docs.

Implementations

impl Cursor

pub fn new(last_key: Vec<u8>, snapshot_id: u64) -> Self

Construct a cursor for the page that ends at last_key.

pub fn encode(&self, audit_key: &[u8; 32]) -> String

Encode + sign the cursor under audit_key. Returns the base64url-encoded wire form ready for next_cursor.

pub fn encode_bound(&self, audit_key: &[u8; 32], binding: &[u8]) -> String

As Cursor::encode, but additionally binds binding into the HMAC — without placing it on the wire.

This is how a paginated query pins the filters a cursor was minted under. The bytes are covered by the tag but not transmitted, so the wire format is unchanged and a caller cannot rewrite them. Resuming with a different binding fails verification and surfaces as AppError::InvalidCursor, which is what stops a consumer from paging with one filter set and continuing with another — a silent way to skip entries that must never happen on an audit log.

Callers with no binding use Cursor::encode, which passes an empty slice and is therefore wire- and tag-compatible with cursors minted before this method existed.

pub fn decode(wire: &str, audit_key: &[u8; 32]) -> Result<Self, AppError>

Decode + verify a wire-form cursor. Returns AppError::InvalidCursor on any failure (malformed, tampered, or signed under a different key) — the error deliberately doesn’t reveal which.

pub fn decode_bound( wire: &str, audit_key: &[u8; 32], binding: &[u8], ) -> Result<Self, AppError>

As Cursor::decode, but requires the cursor to have been minted with the same binding (see Cursor::encode_bound). A mismatch is indistinguishable from a tampered cursor and yields AppError::InvalidCursor.

Trait Implementations

impl Clone for Cursor

fn clone(&self) -> Cursor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Cursor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Cursor

impl PartialEq for Cursor

fn eq(&self, other: &Cursor) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Cursor