Public declaration syntax from forge-rs/crates/forge-auth/src/tool_auth.rs
Original source SHA-256: 2f11976a64a484f2d027bb5f49ab9f0f2878a960867ad8f9968e1dcced04fd06
Function bodies and constant values are omitted. This is not the complete implementation.

Source line 57
#[derive(Debug)]
pub struct ToolAuthorizationRequest<'a> {
/// The OAS DID of the agent requesting tool invocation.

pub agent_did: String,
/// The name of the tool being invoked.

pub tool_name: String,
/// The tier classification of the tool.

pub tool_tier: ToolTier,
/// The agent's Arsenal ACT, if available.

///

/// When `None`, the request is processed in legacy mode (no ACT checks).

pub act: Option<&'a AgentCapabilityToken>
}

Source line 79
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub enum ToolAuthorizationDecision {
    /// The tool invocation is authorized.
    ///
    /// Returned for:
    /// - Tier 1 (Platform) tools — always allowed.
    /// - Tier 3 (Embedded) tools — always allowed.
    /// - Tier 2 (Host) tools — when the ACT grants the required scope.
    Allowed,

    /// The tool invocation is denied.
    ///
    /// Returned for Tier 2 (Host) tools when the ACT does not grant the
    /// required scope. The `reason` field provides an actionable explanation.
    Denied {
        /// Human-readable explanation of why the tool was denied.
        reason: String,
    },

    /// No ACT was provided — operating in legacy mode.
    ///
    /// Legacy mode allows tool execution without authorization. This mode
    /// exists for backward compatibility during the OAS integration migration.
    /// A `WARN`-level log is emitted when this mode is triggered.
    ///
    /// Legacy mode will be removed in a future major version.
    LegacyMode,
}

Source line 112
#[must_use]
pub fn is_allowed(&self) -> bool;

Source line 118
#[must_use]
pub fn is_denied(&self) -> bool;

Source line 124
#[must_use]
pub fn is_legacy_mode(&self) -> bool;

Source line 202
#[instrument(
    skip(request),
    fields(
        agent_did = %request.agent_did,
        tool = %request.tool_name,
        tier = %request.tool_tier,
        has_act = request.act.is_some()
    )
)]
pub fn authorize_tool_invocation(
    request: &ToolAuthorizationRequest<'_>,
) -> ForgeAuthResult<ToolAuthorizationDecision>;

Source line 292
#[instrument(
    skip(request, variables),
    fields(
        agent_did = %request.agent_did,
        tool = %request.tool_name,
        variable_count = variables.len()
    )
)]
pub fn authorize_proxy_tool_invocation(
    request: &ToolAuthorizationRequest<'_>,
    variables: &[String],
) -> ForgeAuthResult<ToolAuthorizationDecision>;