Class CapabilityGrant

Namespace

AsiBackbone.Core.CapabilityGrants

Assembly

AsiBackbone.Core.dll

Represents a provider-neutral, short-lived capability grant for follow-on governed execution.

public sealed class CapabilityGrant

Inheritance

object

CapabilityGrant

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The grant is a metadata model, not a bearer-token format. Hosts decide how this grant is serialized, transported, protected, and bound to their authentication and authorization systems.

Properties

AcknowledgmentId

Gets the acknowledgment identifier bound to the grant, when supplied.

public string? AcknowledgmentId { get; }

Property Value

string

Audience

Gets the intended audience for the grant.

public string Audience { get; }

Property Value

string

ExpiresUtc

Gets the UTC timestamp when the grant expires.

public DateTimeOffset ExpiresUtc { get; }

Property Value

DateTimeOffset

GatewayBinding

Gets the optional gateway binding used to limit execution context.

public string? GatewayBinding { get; }

Property Value

string

HandshakeId

Gets the handshake identifier bound to the grant, when supplied.

public string? HandshakeId { get; }

Property Value

string

HasAcknowledgmentReference

Gets a value indicating whether an acknowledgment reference is present.

public bool HasAcknowledgmentReference { get; }

Property Value

bool

HasHandshakeReference

Gets a value indicating whether a handshake reference is present.

public bool HasHandshakeReference { get; }

Property Value

bool

HasMetadata

Gets a value indicating whether additional metadata is present.

public bool HasMetadata { get; }

Property Value

bool

IssuedUtc

Gets the UTC timestamp when the grant was issued.

public DateTimeOffset IssuedUtc { get; }

Property Value

DateTimeOffset

Issuer

Gets the issuer that created the grant.

public string Issuer { get; }

Property Value

string

MaxUseCount

Gets the maximum number of times the issuer permits this grant to be used, when the issuer bound one.

public int? MaxUseCount { get; }

Property Value

int?

Remarks

A use limit supplied only at the validation call site is a local policy choice that the issuer never authorized and that nothing in the signature covers. When this value is present it is part of the signed payload, so a relying party cannot widen it. Validation uses the narrower of this value and any limit the caller supplies.

Metadata

Gets provider-neutral metadata carried with the grant.

public IReadOnlyDictionary<string, string> Metadata { get; }

Property Value

IReadOnlyDictionary<string, string>

NotBeforeUtc

Gets the UTC timestamp before which the grant is not valid.

public DateTimeOffset? NotBeforeUtc { get; }

Property Value

DateTimeOffset?

OperationName

Gets the operation name or action family the grant is intended to authorize.

public string? OperationName { get; }

Property Value

string

PolicyHash

Gets the policy hash bound to the grant, when supplied.

public string? PolicyHash { get; }

Property Value

string

PolicyVersion

Gets the policy version bound to the grant, when supplied.

public string? PolicyVersion { get; }

Property Value

string

ResourceBinding

Gets the optional resource binding used to limit the target resource.

public string? ResourceBinding { get; }

Property Value

string

SchemaVersion

Gets the canonical schema version for this grant.

public string SchemaVersion { get; }

Property Value

string

Scopes

Gets the least-privilege scopes carried by the grant.

public IReadOnlyList<string> Scopes { get; }

Property Value

IReadOnlyList<string>

SubjectId

Gets the host-defined subject identifier, when supplied.

public string? SubjectId { get; }

Property Value

string

TokenId

Gets the stable grant identifier used for validation and replay checks.

public string TokenId { get; }

Property Value

string

Methods

Create(string, string, string, IEnumerable<string>, DateTimeOffset, DateTimeOffset, DateTimeOffset?, string?, string?, string?, string?, string?, string?, string?, string?, IReadOnlyDictionary<string, string>?, int?, string?)

Creates a provider-neutral capability grant.

public static CapabilityGrant Create(string tokenId, string issuer, string audience, IEnumerable<string> scopes, DateTimeOffset issuedUtc, DateTimeOffset expiresUtc, DateTimeOffset? notBeforeUtc = null, string? subjectId = null, string? operationName = null, string? policyVersion = null, string? policyHash = null, string? acknowledgmentId = null, string? handshakeId = null, string? gatewayBinding = null, string? resourceBinding = null, IReadOnlyDictionary<string, string>? metadata = null, int? maxUseCount = null, string? schemaVersion = null)

Parameters

tokenId string

issuer string

audience string

scopes IEnumerable<string>

issuedUtc DateTimeOffset

expiresUtc DateTimeOffset

notBeforeUtc DateTimeOffset?

subjectId string

operationName string

policyVersion string

policyHash string

acknowledgmentId string

handshakeId string

gatewayBinding string

resourceBinding string

metadata IReadOnlyDictionary<string, string>

maxUseCount int?

schemaVersion string

Returns

CapabilityGrant