Source: arsenal/crates/arsenal-core/src/constraints.rs. SHA-256: 1d21f4bb1d751b9f986249d128ad97ed164d9f21534029f2cd3c715e61265bda.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

constraints::Constraints

Constraints that must be satisfied for a token to be valid

#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct Constraints {
/// Device binding - token only valid from specific device

#[serde(skip_serializing_if = "Option::is_none")]
pub device_binding: Option<DeviceBinding>,
/// Session binding - token bound to a specific session

#[serde(skip_serializing_if = "Option::is_none")]
pub session_binding: Option<SessionBinding>,
/// Browser/origin binding - token only valid from specific origins

#[serde(skip_serializing_if = "Option::is_none")]
pub origin_binding: Option<OriginBinding>,
/// Network constraints - IP allowlist/denylist

#[serde(skip_serializing_if = "Option::is_none")]
pub network_constraints: Option<NetworkConstraints>,
/// Time-based constraints

#[serde(skip_serializing_if = "Option::is_none")]
pub time_constraints: Option<TimeConstraints>,
/// Environment constraints

#[serde(skip_serializing_if = "Option::is_none")]
pub environment_constraints: Option<EnvironmentConstraint>,
/// Proof-of-possession required

#[serde(default)]
pub require_pop: bool
}

Source line: 15.

constraints::Constraints::none

Create empty constraints (no restrictions)

#[must_use]
pub fn none() -> Self;

Source line: 48.

constraints::Constraints::with_pop

Create constraints requiring proof-of-possession

#[must_use]
pub fn with_pop() -> Self;

Source line: 54.

constraints::Constraints::with_device

Add device binding

#[must_use]
pub fn with_device(mut self, device_id: DeviceId) -> Self;

Source line: 63.

constraints::Constraints::with_origins

Add origin binding

#[must_use]
pub fn with_origins(mut self, origins: Vec<String>) -> Self;

Source line: 73.

constraints::Constraints::with_time_window

Add time constraints

#[must_use]
pub fn with_time_window(
        mut self,
        not_before: chrono::DateTime<chrono::Utc>,
        not_after: chrono::DateTime<chrono::Utc>,
    ) -> Self;

Source line: 82.

constraints::Constraints::validate

Check if all constraints are satisfied

Errors

Returns an error if any constraint is violated.

pub fn validate(&self, context: &ConstraintContext) -> ArsenalResult<()>;

Source line: 101.

constraints::DeviceBinding

Device binding configuration

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DeviceBinding {
/// The device this token is bound to

pub device_id: DeviceId,
/// Type of binding

pub binding_type: BindingType
}

Source line: 126.

constraints::SessionBinding

Session binding configuration

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SessionBinding {
/// The session ID this token is bound to

pub session_id: String,
/// Hash of the session key for verification

pub session_key_hash: Option<[u8; 32]>
}

Source line: 155.

constraints::OriginBinding

Origin binding configuration

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct OriginBinding {
/// Allowed origins

pub allowed_origins: HashSet<String>
}

Source line: 192.

constraints::NetworkConstraints

Network constraints

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct NetworkConstraints {
/// Allowed IP addresses

#[serde(default)]
pub allowed_ips: HashSet<IpAddr>,
/// Denied IP addresses

#[serde(default)]
pub denied_ips: HashSet<IpAddr>,
/// Allowed CIDR ranges

#[serde(default)]
pub allowed_cidrs: Vec<String>,
/// Allowed ASNs

#[serde(default)]
pub allowed_asns: HashSet<u32>
}

Source line: 217.

constraints::TimeConstraints

Time-based constraints

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TimeConstraints {
/// Token not valid before this time

#[serde(skip_serializing_if = "Option::is_none")]
pub not_before: Option<chrono::DateTime<chrono::Utc>>,
/// Token not valid after this time

#[serde(skip_serializing_if = "Option::is_none")]
pub not_after: Option<chrono::DateTime<chrono::Utc>>,
/// Allowed hours of day (0-23)

#[serde(skip_serializing_if = "Option::is_none")]
pub allowed_hours: Option<Vec<u8>>,
/// Allowed days of week (0=Sunday, 6=Saturday)

#[serde(skip_serializing_if = "Option::is_none")]
pub allowed_days: Option<Vec<u8>>
}

Source line: 267.

constraints::EnvironmentConstraint

Environment constraints

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct EnvironmentConstraint {
/// Required environment

#[serde(skip_serializing_if = "Option::is_none")]
pub required_environment: Option<String>,
/// Required tags that must be present

#[serde(default)]
pub required_tags: HashSet<String>,
/// Forbidden tags that must not be present

#[serde(default)]
pub forbidden_tags: HashSet<String>
}

Source line: 307.

constraints::BindingType

Type of binding enforcement

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum BindingType {
    /// Binding must be satisfied
    Required,
    /// Binding is preferred but not required
    Preferred,
}

Source line: 358.

constraints::ConstraintContext

Context for constraint validation

#[derive(Debug, Clone, Default)]
pub struct ConstraintContext {
/// Current time for time-based checks

pub current_time: chrono::DateTime<chrono::Utc>,
/// Device ID if available

pub device_id: Option<DeviceId>,
/// Session ID if available

pub session_id: Option<String>,
/// Session key hash if available

pub session_key_hash: Option<[u8; 32]>,
/// Request origin if available

pub origin: Option<String>,
/// Client IP address if available

pub client_ip: Option<IpAddr>,
/// Current environment

pub environment: Option<String>,
/// Current tags

pub tags: HashSet<String>
}

Source line: 367.

constraints::ConstraintContext::now

Create a new context with current time

#[must_use]
pub fn now() -> Self;

Source line: 389.

constraints::ConstraintContext::with_device

Set device ID

#[must_use]
pub fn with_device(mut self, device_id: DeviceId) -> Self;

Source line: 398.

constraints::ConstraintContext::with_session

Set session ID

#[must_use]
pub fn with_session(mut self, session_id: impl Into<String>) -> Self;

Source line: 405.

constraints::ConstraintContext::with_origin

Set origin

#[must_use]
pub fn with_origin(mut self, origin: impl Into<String>) -> Self;

Source line: 412.

constraints::ConstraintContext::with_client_ip

Set client IP

#[must_use]
pub fn with_client_ip(mut self, ip: IpAddr) -> Self;

Source line: 419.

constraints::ConstraintContext::with_environment

Set environment

#[must_use]
pub fn with_environment(mut self, env: impl Into<String>) -> Self;

Source line: 426.

constraints::ConstraintContext::with_tag

Add a tag

#[must_use]
pub fn with_tag(mut self, tag: impl Into<String>) -> Self;

Source line: 433.

arsenal-core · constraints