Class: KairosMcp::Daemon::ElevationToken

Inherits:
Object
  • Object
show all
Defined in:
lib/kairos_mcp/daemon/elevation_token.rb

Overview

ElevationToken — opaque, unforgeable grant for temporary policy elevation.

Design (P3.2 v0.2 §5.1, MF2 fix):

Identity comparison via equal? (object_id). Even if an attacker
knows the proposal_id, they cannot forge a token that passes matches?.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(proposal_id:, scope:, granted_by:) ⇒ ElevationToken

Returns a new instance of ElevationToken.



16
17
18
19
20
21
 
# File 'lib/kairos_mcp/daemon/elevation_token.rb', line 16

def initialize(proposal_id:, scope:, granted_by:)
  @proposal_id = proposal_id.freeze
  @scope       = scope.freeze
  @granted_by  = granted_by.freeze
  @granted_at  = Time.now.utc.iso8601.freeze
end

Instance Attribute Details

#granted_at ⇒ Object (readonly)

Returns the value of attribute granted_at.



14
15
16
 
# File 'lib/kairos_mcp/daemon/elevation_token.rb', line 14

def granted_at
  @granted_at
end

#granted_by ⇒ Object (readonly)

Returns the value of attribute granted_by.



14
15
16
 
# File 'lib/kairos_mcp/daemon/elevation_token.rb', line 14

def granted_by
  @granted_by
end

#proposal_id ⇒ Object (readonly)

Returns the value of attribute proposal_id.



14
15
16
 
# File 'lib/kairos_mcp/daemon/elevation_token.rb', line 14

def proposal_id
  @proposal_id
end

#scope ⇒ Object (readonly)

Returns the value of attribute scope.



14
15
16
 
# File 'lib/kairos_mcp/daemon/elevation_token.rb', line 14

def scope
  @scope
end

Instance Method Details

#matches?(other) ⇒ Boolean

Identity comparison — only the exact token object matches.

Parameters:

Returns:

  • (Boolean) 


26
27
28
 
# File 'lib/kairos_mcp/daemon/elevation_token.rb', line 26

def matches?(other)
  other.equal?(self)
end

#to_h ⇒ Object 



30
31
32
33
 
# File 'lib/kairos_mcp/daemon/elevation_token.rb', line 30

def to_h
  { proposal_id: @proposal_id, scope: @scope,
    granted_by: @granted_by, granted_at: @granted_at }
end