Struct DelegationVerifier

pub struct DelegationVerifier { /* private fields */ }

Verifies JWS tokens using a key registry of public keys.

The verifier holds an internal HashMap<kid, (Algorithm, VerifyingKey)>. When a token is verified, the registry is consulted to find the matching key, and the EdDSA signature is checked cryptographically.

Implementations

impl DelegationVerifier

pub fn new() -> Self

pub fn set_clock_skew_seconds(&self, secs: i64)

Set the clock-skew tolerance (seconds) used when comparing exp / nbf to “now”.

pub fn clock_skew_seconds(&self) -> i64

pub fn add_key( &self, kid: impl Into<String>, alg: Algorithm, raw: &[u8], ) -> Result<()>

Add a public key (raw Ed25519 bytes).

Replaces any existing key under the same kid. Returns Err when the key bytes are invalid (wrong length, bad parse) so callers see the failure rather than silently dropping it.

pub fn clear(&self)

Remove all keys.

pub fn key_count(&self) -> usize

Number of registered keys.

pub fn verify( &self, token: &str, expected_aud: &str, now_unix: i64, ) -> Result<VerifiedDelegation>

Verify the JWS signature, then validate standard claims (exp, nbf, aud). Returns the verified claims on success.

This is the secure entry point — unlike DelegationToken::parse, it actually verifies the EdDSA signature, AgentGuard token type, and standard identity/time claims.

Errors

Returns Error::TokenSignature if the signature is invalid or the kid is unknown. Returns Error::TokenExpired if now_unix is past exp + clock_skew_seconds. Returns Error::TokenNotYetValid if iat or nbf is in the future beyond the configured skew. Returns Error::InvalidToken for any JWS parse / base64 / signature-format error or audience mismatch.

Examples

use agentguard_core::{DelegationConfig, DelegationSigner, DelegationVerifier,
    auth_keys::Algorithm};
use base64::Engine as _;

let signer = DelegationSigner::generate();
let verifier = DelegationVerifier::new();
let pub_bytes = base64::engine::general_purpose::STANDARD
    .decode(signer.public_key_b64()).unwrap();
verifier.add_key(signer.key_id(), Algorithm::EdDSA, &pub_bytes).unwrap();
let token = signer.mint("alice", "summarizer", "aud",
    vec!["ToolCall::send".into()],
    vec!["Mailbox::*".into()],
    DelegationConfig::default()).unwrap();
let verified = verifier.verify(&token.jws, "aud", chrono::Utc::now().timestamp()).unwrap();
assert_eq!(verified.claims().iss, "alice");
assert_eq!(verified.claims().aud, "aud");

pub async fn verify_with_revocation_store( &self, token: &str, expected_aud: &str, now_unix: i64, store: &dyn DelegationRevocationStore, ) -> Result<VerifiedDelegation>

Verify a token and require a successful shared revocation-state check. Storage errors propagate; callers must never continue with the cryptographically verified grant when the revocation store is unavailable.

pub async fn revoke( &self, verified: &VerifiedDelegation, store: &dyn DelegationRevocationStore, ) -> Result<()>

Revoke a verified grant in the supplied shared store. The retention deadline includes this verifier’s configured expiry clock skew.

Trait Implementations

impl Default for DelegationVerifier

fn default() -> DelegationVerifier

Returns the “default value” for a type.