hellhound - v0.2.0

hellhound/assertion

Standalone signed JWT assertions. No discovery, network or implicit clock. Registered claims are optional here; the caller’s protocol profile decides which are required. Custom JSON claims cannot replace registered claims. Material is redacted during ordinary inspection; to_string exposes the compact credential deliberately. This module does not issue checked identity.

Types

Assertion

opaque </> 
pub opaque type Assertion

Claims

opaque </> 
pub opaque type Claims

Options

</>

Protected header options. None omits kid/typ, including a JWK’s own kid. alg is always derived from the explicit compatible algorithm.

pub type Options {
  Options(
    algorithm: config.SigningAlgorithm,
    key_id: option.Option(String),
    token_type: option.Option(String),
  )
}

Constructors

SignError

</> 
pub type SignError {
  ReservedClaim
  DuplicateClaim
  InvalidAudience
  InvalidHeader
  UnsupportedAlgorithm
  PayloadTooLarge
  SigningFailed
}

Constructors 

  • ReservedClaim
  • DuplicateClaim
  • InvalidAudience
  • InvalidHeader
  • UnsupportedAlgorithm
  • PayloadTooLarge
  • SigningFailed

Values

claims

</> 
pub fn claims() -> Claims

options

</> 
pub fn options(algorithm: config.SigningAlgorithm) -> Options

sign

</> 
pub fn sign(
  claims: Claims,
  key: config.SigningKey,
  algorithm: config.SigningAlgorithm,
) -> Result(Assertion, SignError)

Sign with typ JWT and the key’s identifier, when present.

sign_with_options

</> 
pub fn sign_with_options(
  claims: Claims,
  key: config.SigningKey,
  options: Options,
) -> Result(Assertion, SignError)

to_string

</> 
pub fn to_string(assertion: Assertion) -> String

Expose the compact credential for deliberate transmission. Do not log it.

with_audience

</> 
pub fn with_audience(claims: Claims, audience: String) -> Claims

with_audiences

</> 
pub fn with_audiences(
  claims: Claims,
  audiences: List(String),
) -> Claims

with_claim

</> 
pub fn with_claim(
  claims: Claims,
  name: String,
  value: json.Json,
) -> Claims

Add a custom JSON claim. Registered names and duplicate custom names make this Claims value invalid; sign returns the first construction error.

with_expiration

</> 
pub fn with_expiration(
  claims: Claims,
  expires_at: timestamp.Timestamp,
) -> Claims

NumericDates use whole Unix seconds. No system clock is read.

with_issued_at

</> 
pub fn with_issued_at(
  claims: Claims,
  issued_at: timestamp.Timestamp,
) -> Claims

with_issuer

</> 
pub fn with_issuer(claims: Claims, issuer: String) -> Claims

with_jwt_id

</> 
pub fn with_jwt_id(claims: Claims, id: String) -> Claims

with_not_before

</> 
pub fn with_not_before(
  claims: Claims,
  not_before: timestamp.Timestamp,
) -> Claims

with_subject

</> 
pub fn with_subject(claims: Claims, subject: String) -> Claims
✨ Search Document