Add resource-scoped bearer access metadata

crates/geth-secrets/src/lib.rs

@@ -45,3 +45,55 @@ impl BearerAccess {
         }
     }
 }
+
+#[derive(Debug, thiserror::Error)]
+pub enum SecretsError {
+    #[error("bearer access must grant at least one capability")]
+    EmptyBearerCapabilities,
+    #[error("capability is not allowed for bearer access: {0}")]
+    ForbiddenBearerCapability(String),
+}
+
+pub fn validate_bearer_capabilities(capabilities: &[Capability]) -> Result<(), SecretsError> {
+    if capabilities.is_empty() {
+        return Err(SecretsError::EmptyBearerCapabilities);
+    }
+    for capability in capabilities {
+        let capability = capability.as_str();
+        if matches!(
+            capability,
+            "auth.delegate"
+                | "auth.revoke"
+                | "trust.modify"
+                | "ssh_proxy.admin_shell"
+                | "node.enroll"
+        ) {
+            return Err(SecretsError::ForbiddenBearerCapability(
+                capability.to_owned(),
+            ));
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn bearer_capabilities_reject_trust_mutation() {
+        assert!(validate_bearer_capabilities(&["kv.read".into(), "kv.write".into()]).is_ok());
+        assert!(matches!(
+            validate_bearer_capabilities(&[]),
+            Err(SecretsError::EmptyBearerCapabilities)
+        ));
+        assert!(matches!(
+            validate_bearer_capabilities(&["auth.delegate".into()]),
+            Err(SecretsError::ForbiddenBearerCapability(_))
+        ));
+        assert!(matches!(
+            validate_bearer_capabilities(&["node.enroll".into()]),
+            Err(SecretsError::ForbiddenBearerCapability(_))
+        ));
+    }
+}