Generate a random keypair

Construct a keypair from a private key

A private key used to generate a biscuit

A public key used to generate a biscuit

A keypair containing both a private key and a public key

Get an hex bytestring from a private key

Get an hex bytestring from a public key

Read a private key from an hex bytestring

Read a public key from an hex bytestring

Serialize a private key to raw bytes

Serialize a public key to raw bytes

Parse a private key from raw bytes. This returns Nothing if the raw bytes don't have the expected length

Parse a public key from raw bytes. This returns Nothing if the raw bytes don't have the expected length

Quasiquoter for a block expression. You can reference haskell variables like this: ${variableName}.

A typical use of block looks like this:

[block|
  resource(#authority, ${fileName});
  rule($variable) <- fact($value), other_fact($value);
  check if operation(#ambient, #read);
|]

Build a block containing an explicit context value. The context of a block can't be parsed from datalog currently, so you'll need an explicit call to blockContext to add it

    [block|check if time(#ambient, $t), $t < 2021-01-01;|]
 <> blockContext "ttl-check"

Create a new biscuit with the provided authority block

Add a block to an existing biscuit. The block will be signed with a randomly-generated keypair

A parsed biscuit

A biscuit block, containing facts, rules and checks.

Block has a Monoid instance, this is the expected way to build composite blocks (eg if you need to generate a list of facts):

-- build a block containing a list of facts `value("a"); value("b"); value("c");`.
foldMap (\v -> [block| value(${v}) |]) ["a", "b", "c"]

Serialize a biscuit to URL-compatible base 64, as recommended by the spec

Parse a biscuit from a URL-compatible base 64 encoded bytestring

Parse a biscuit from a raw bytestring. If you want to parse from a URL-compatible base 64 bytestring, consider using parseB64 instead

Serialize a biscuit to a binary format. If you intend to send the biscuit over a text channel, consider using serializeB64 or serializeHex instead

Parse a biscuit from an hex-encoded bytestring

Serialize a biscuit to a hex (base 16) string. Be advised that the specs recommends base 64 instead.

Quasiquoter for a verifier expression. You can reference haskell variables like this: ${variableName}.

A typical use of block looks like this:

[verifier|
  current_time(#ambient, ${now});
  allow if resource(#authority, "file1");
  deny if true;
|]

Same as verifyBiscuitWithLimits, but with default limits (1ms timeout, max 1000 facts, max 100 iterations)

Given a provided verifier (a set of facts, rules, checks and policies), and a public key, verify a biscuit:

• make sure the biscuit has been signed with the private key associated to the public key
• make sure the biscuit is valid for the provided verifier

Only check a biscuit signature. This can be used to perform an early check, before bothering with constructing a verifier.

Default settings for the executor restrictions. (1000 facts, 100 iterations, 1000μs max, regexes are allowed, facts and rules are allowed in blocks)

A biscuit verifier, containing, facts, rules, checks and policies

Errors that can happen when parsing a biscuit

An error that can happen when verifying a biscuit

The result of running verification

Settings for the executor restrictions See defaultLimits for default values.