Biscuit-Auth

Biscuit-Auth is the reference Rust implementation of Biscuit, an authorization token designed for microservices architectures. Any node holding the root public key can validate a token offline, and a token holder can attenuate rights and mint a new valid token without contacting the issuer.

Authorization logic is expressed in a compact Datalog dialect, letting you encode capability-based checks, time bounds, resource prefixes, and complex delegation rules directly inside the token. Tokens stay small enough to fit in a cookie while carrying their own cryptographically verifiable policy.

What You Get

• A Biscuit builder and parser for creating, serializing, and verifying tokens
• An Authorizer that evaluates allow/deny policies and checks against request context
• A Datalog engine with facts, rules, and expressions for capability-based authorization
• Compile-time datalog macros (biscuit!, block!, authorizer!) via the biscuit-quote crate
• Ed25519 and P-256 key pair support, plus third-party block and PEM/DER key handling

Common Use Cases

• Issuing decentralized bearer tokens for microservice-to-microservice authorization
• Delegating scoped access by attenuating an existing token offline
• Embedding fine-grained, capability-based access rules inside a compact token

Under The Hood

Architecture — The crate centers on the token module, where Biscuit (in token/mod.rs, builder.rs, block.rs) represents an ordered list of signed blocks and Authorizer (token/authorizer/) evaluates policies against them. Blocks carry Datalog facts and rules parsed and evaluated by the datalog module (expression.rs, symbol.rs, origin.rs), while the format module encodes tokens via a Protobuf schema (format/schema.proto, convert.rs) using a symbol table to keep them small. The crypto module (ed25519.rs, p256.rs) signs and verifies each appended block so tampering breaks verification.

Tech Stack — Written in Rust (edition 2018) with prost for Protobuf, ed25519-dalek and p256/ecdsa/elliptic-curve for signatures, nom for Datalog parsing, regex, time, zeroize, and thiserror. Feature flags gate optional pieces (compile-time datalog-macro via biscuit-quote, wasm, serde-error, pem, uuid). It is organized as a Cargo workspace with sibling crates biscuit-parser, biscuit-quote, and biscuit-capi.

Code Quality — The library is modular and heavily documented via rustdoc, with integration tests (tests/macros.rs, tests/rights.rs), roughly 14 source files carrying #[test] blocks, and four runnable examples. Errors are modeled explicitly with thiserror in error.rs, and cryptographic key material is wrapped with zeroize.

API Design — The public surface is ergonomic: KeyPair::new(), Biscuit::builder, .append(block!(...)), and authorizer!(...).build(&biscuit)?.authorize() read naturally, and the datalog macros let policies be written inline with compile-time checking. The main cost is conceptual — users must learn the Datalog policy model — but the API itself keeps boilerplate minimal.