Module auth 

API token model for inbound authentication (#2, ADR-0010).

Tokens are pspo_ + 32 random bytes (base64url, no padding). prosperod stores only SHA-256 hashes, declared one per line in a tokens file: <name> <scope> sha256:<hex>. Kept here (not in prospero-api) so the CLI’s offline prospero token new shares the exact format.

Structs

TokenEntry

One configured token.

TokenSet

The parsed tokens file.

TokensFileError

A tokens-file problem. The message names the file/line, never a hash.

Enums

Scope

A token’s permission level. Ordered: Read < Operate < Admin, so a route’s requirement is met when principal.scope >= required.

Constants

TOKEN_PREFIX

Prefix on every generated token, so leaked tokens are greppable.

Functions

constant_time_eq

Constant-time byte-string equality: early exit only on a length mismatch (lengths aren’t secret), then XOR-accumulate every byte. Shared by the session-plane preamble check and inbound API auth.

format_hash

sha256:<lowercase hex>.

generate_token

A fresh random token.

hash_token

SHA-256 over the full token string.

tokens_file_line

The tokens-file line for a freshly generated token.

validate_token_name

[a-z0-9][a-z0-9_-]{0,62}.