Public declaration syntax from forge-rs/crates/forge-contracts/src/auth.rs
Original source SHA-256: 98c9b6c97f10338f266df9de07417771d9ba69e3bcd6c52e87e56a4945e34106
Function bodies and constant values are omitted. This is not the complete implementation.

Source line 55
pub const CONTRACT_VERSION: &str;

Source line 71
#[derive(Debug, Clone, Serialize, Deserialize)]
pub enum AuthDecision {
    /// Authorization was granted.
    Allowed {
        /// The specific scope that was matched.
        scope: String,
        /// When this authorization expires, if applicable.
        expires_at: Option<DateTime<Utc>>,
    },
    /// Authorization was denied.
    Denied {
        /// The scope that was requested.
        requested_scope: String,
        /// The reason for denial.
        reason: String,
    },
}

Source line 90
pub fn is_allowed(&self) -> bool;

Source line 95
pub fn is_denied(&self) -> bool;

Source line 123
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct CapabilityNarrowingRequest {
/// The parent agent's DID (must have a valid ACT).

pub parent_did: String,
/// The child agent's DID (will receive the narrowed ACT).

pub child_did: String,
/// The scopes to grant to the child. Must be a subset of parent's scopes.

pub requested_scopes: Vec<String>,
/// Optional time-to-live in seconds for the child's token.

/// If `None`, inherits the parent's expiration.

pub ttl_seconds: Option<u64>,
/// Maximum delegation chain depth. If the parent is already at

/// this depth, delegation fails.

pub max_delegation_depth: u32
}

Source line 146
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DelegationChainEntry {
/// The delegator's DID.

pub delegator_did: String,
/// The delegatee's DID.

pub delegatee_did: String,
/// The scopes that were delegated.

pub scopes: Vec<String>,
/// When the delegation was created.

pub created_at: DateTime<Utc>,
/// When the delegation expires.

pub expires_at: Option<DateTime<Utc>>,
/// Depth in the delegation chain (0 = root grant).

pub depth: u32
}

Source line 171
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct CapabilityTokenHandle {
/// Unique identifier for this token.

pub token_id: String,
/// The agent DID this token belongs to.

pub agent_did: String,
/// The scopes granted by this token.

pub scopes: Vec<String>,
/// When this token expires, if applicable.

pub expires_at: Option<DateTime<Utc>>,
/// Depth in the delegation chain.

pub delegation_depth: u32
}

Source line 210
#[async_trait]
pub trait AuthContract: Send + Sync {
    /// Checks whether an agent is authorized for a specific scope.
    ///
    /// # Arguments
    ///
    /// * `agent_did` - The agent requesting authorization.
    /// * `scope` - The scope to check (e.g., "tool:web_search",
    ///   "memory:write:department:engineering").
    ///
    /// # Returns
    ///
    /// An `AuthDecision` indicating whether access is granted or denied.
    ///
    /// # Errors
    ///
    /// - `ContractError::DidResolutionFailed` if the agent's DID cannot
    ///   be resolved to find its ACT.
    async fn check_authorization(
        &self,
        agent_did: &str,
        scope: &str,
    ) -> ContractResult<AuthDecision>;

    /// Creates a narrowed capability token for a child agent.
    ///
    /// # Arguments
    ///
    /// * `request` - The narrowing parameters.
    ///
    /// # Returns
    ///
    /// A handle to the newly created child token.
    ///
    /// # Errors
    ///
    /// - `ContractError::CapabilityEscalation` if any requested scope
    ///   exceeds the parent's grants.
    /// - `ContractError::TokenExpired` if the parent's token has expired.
    async fn delegate_capabilities(
        &self,
        request: CapabilityNarrowingRequest,
    ) -> ContractResult<CapabilityTokenHandle>;

    /// Revokes a capability token, immediately invalidating it.
    ///
    /// Revocation cascades: revoking a parent token also revokes all
    /// tokens derived from it.
    ///
    /// # Arguments
    ///
    /// * `token_id` - The token to revoke.
    ///
    /// # Errors
    ///
    /// - `ContractError::AuthorizationDenied` if the caller does not
    ///   have authority to revoke this token.
    async fn revoke_token(&self, token_id: &str) -> ContractResult<()>;

    /// Returns the full delegation chain for an agent's current token.
    ///
    /// # Arguments
    ///
    /// * `agent_did` - The agent whose delegation chain to retrieve.
    ///
    /// # Returns
    ///
    /// The chain of delegations from root to the agent, ordered by depth.
    ///
    /// # Errors
    ///
    /// - `ContractError::DidResolutionFailed` if the agent DID cannot
    ///   be resolved.
    async fn get_delegation_chain(
        &self,
        agent_did: &str,
    ) -> ContractResult<Vec<DelegationChainEntry>>;

    /// Lists all scopes currently granted to an agent.
    ///
    /// # Arguments
    ///
    /// * `agent_did` - The agent to query.
    ///
    /// # Returns
    ///
    /// The list of scope strings currently active for this agent.
    async fn list_scopes(&self, agent_did: &str) -> ContractResult<Vec<String>>;
}