Struct KeyAuthorization 

pub struct KeyAuthorization {
    pub chain_id: u64,
    pub key_type: SignatureType,
    pub key_id: Address,
    pub expiry: Option<NonZeroU64>,
    pub limits: Option<Vec<TokenLimit>>,
    pub allowed_calls: Option<Vec<CallScope>>,
    pub witness: Option<B256>,
    pub is_admin: bool,
    pub account: Option<Address>,
}

Key authorization for provisioning access keys

Used in TempoTransaction to add a new key to the AccountKeychain precompile. The transaction must be signed by the root key, or by an active admin key when authorizing for the admin key’s account.

RLP encoding: [chain_id, key_type, key_id, expiry?, limits?, allowed_calls?, witness?, is_admin?, account?]

• Non-optional fields come first, followed by optional (trailing) fields
• expiry: None (omitted or 0x80) = key never expires, Some(timestamp) = expires at timestamp
• limits: None (omitted or 0x80) = unlimited spending, Some([]) = no spending, Some([...]) = specific limits
• allowed_calls: None (canonically omitted, explicit 0x80 accepted) = unrestricted, Some([]) = scoped with no allowed calls, Some([...]) = scoped calls
• witness: None (canonically omitted) = no TIP-1053 witness, Some(bytes32) = arbitrary signed witness checked against the account’s burned set.

Fields

chain_id: u64

Chain ID for replay protection. Pre-T1C: 0 = valid on any chain (wildcard). T1C+: must match current chain.

key_type: SignatureType

Type of key being authorized (Secp256k1, P256, or WebAuthn)

key_id: Address

Key identifier, is the address derived from the public key of the key type.

expiry: Option<NonZeroU64>

Unix timestamp when key expires.

• None (RLP 0x80) = key never expires (stored as u64::MAX in precompile)
• Some(timestamp) = key expires at this timestamp

This uses Option<NonZeroU64> so Some(0) is unrepresentable and cannot silently roundtrip into None.

limits: Option<Vec<TokenLimit>>

TIP20 spending limits for this key.

• None (RLP 0x80) = unlimited spending (no limits enforced)
• Some([]) = no spending allowed (enforce_limits=true but no tokens allowed)
• Some([TokenLimit{...}]) = specific limits enforced

allowed_calls: Option<Vec<CallScope>>

Optional call scopes for this key.

• None (canonically omitted, explicit 0x80 accepted) = unrestricted calls
• Some([]) = scoped mode with no allowed calls
• Some([CallScope{...}]) = explicit target/selector scope list

witness: Option<B256>

Optional TIP-1053 witness for offchain context binding and manual revocation.

None means no witness. Some(witness) means the witness field is present, including when witness == B256::ZERO.

is_admin: bool

Whether this authorization creates an admin access key.

account: Option<Address>

Account this authorization targets.

Required for admin-signed authorizations so signatures cannot be replayed across accounts that share the same admin key. Root-signed authorizations may omit it.

Implementations

impl KeyAuthorization

pub fn unrestricted( chain_id: u64, key_type: SignatureType, key_id: Address, ) -> Self

Create a fully unrestricted key authorization: no expiry, no spending limits, no call scopes.

pub fn with_expiry(self, expiry: u64) -> Self

Set an expiry timestamp on this key authorization.

pub fn with_limits(self, limits: Vec<TokenLimit>) -> Self

Set token spending limits on this key authorization.

pub fn with_allowed_calls(self, allowed_calls: Vec<CallScope>) -> Self

Set call-scope restrictions on this key authorization.

pub fn with_no_spending(self) -> Self

Deny all spending (enforce limits with an empty allowlist).

pub fn with_no_calls(self) -> Self

Deny all calls (scoped mode with an empty allowlist).

pub fn with_witness(self, witness: B256) -> Self

Attach a TIP-1053 witness to this authorization.

pub fn witness(&self) -> Option<B256>

Returns this authorization’s TIP-1053 witness, if present.

pub fn into_admin(self, account: Address) -> Self

Convert this authorization into an account-bound admin-key authorization.

pub fn with_account(self, account: Address) -> Self

Bind this authorization to a target account without making the authorized key admin.

pub fn is_admin(&self) -> bool

Returns whether this authorization creates an admin key.

pub fn signature_hash(&self) -> B256

Computes the authorization message hash for this key authorization.

pub fn has_periodic_limits(&self) -> bool

Returns whether any token limit uses periodic reset semantics.

pub fn has_call_scopes(&self) -> bool

Returns whether this authorization carries explicit call-scope restrictions.

pub fn has_witness(&self) -> bool

Returns whether this authorization carries a TIP-1053 witness field.

pub fn has_unlimited_spending(&self) -> bool

Returns whether this key has unlimited spending (limits is None)

pub fn never_expires(&self) -> bool

Returns whether this key never expires (expiry is None)

pub fn is_legacy_compatible(&self) -> bool

Returns whether this authorization can be encoded with the legacy pre-T3 ABI.

pub fn into_signed( self, signature: PrimitiveSignature, ) -> SignedKeyAuthorization

Convert the key authorization into a SignedKeyAuthorization with a signature.

pub fn validate_chain_id( &self, expected_chain_id: u64, is_t1c: bool, ) -> Result<(), KeyAuthorizationChainIdError>

Validates that this key authorization’s chain_id is compatible with expected_chain_id.

• Post-T1C: chain_id must exactly match (wildcard 0 is no longer allowed).
• Pre-T1C: chain_id == 0 is a wildcard (valid on any chain), otherwise must match.

pub fn size(&self) -> usize

Calculates a heuristic for the in-memory size of the key authorization

Trait Implementations

impl<'a> Arbitrary<'a> for KeyAuthorization

Available on crate features arbitrary only.

fn arbitrary(u: &mut Unstructured<'a>) -> Result<Self>

Generate an arbitrary value of Self from the given unstructured data.

fn arbitrary_take_rest(u: Unstructured<'a>) -> Result<Self, Error>

Generate an arbitrary value of Self from the entirety of the given unstructured data.

fn size_hint(depth: usize) -> (usize, Option<usize>)

Get a size hint for how many bytes out of an Unstructured this type needs to construct itself.

fn try_size_hint( depth: usize, ) -> Result<(usize, Option<usize>), MaxRecursionReached>

Get a size hint for how many bytes out of an Unstructured this type needs to construct itself.

impl Clone for KeyAuthorization

fn clone(&self) -> KeyAuthorization

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyAuthorization

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Decodable for KeyAuthorization

fn decode(buf: &mut &[u8]) -> Result<Self>

Decodes the blob into the appropriate type. buf must be advanced past the decoded object.

impl<'de> Deserialize<'de> for KeyAuthorization

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Encodable for KeyAuthorization

fn encode(&self, out: &mut dyn BufMut)

Encodes the type into the out buffer.

fn length(&self) -> usize

Returns the length of the encoding of this type in bytes.

impl Eq for KeyAuthorization

impl From<&KeyAuthorization> for KeyAuthorizationWire

fn from(value: &KeyAuthorization) -> Self

Converts to this type from the input type.

impl Hash for KeyAuthorization

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for KeyAuthorization

fn eq(&self, other: &KeyAuthorization) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for KeyAuthorization

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for KeyAuthorization

impl TryFrom<KeyAuthorizationWire> for KeyAuthorization

type Error = Error

The type returned in the event of a conversion error.

fn try_from(value: KeyAuthorizationWire) -> Result<Self>

Performs the conversion.

Layout

Note: Most layout information is completely unstable and may even differ between compilations. The only exception is types with certain repr(...) attributes. Please see the Rust Reference's “Type Layout” chapter for details on type layout guarantees.

Size: 144 bytes