Skip to main content

verify

agent_capability_token::wire

Function verify 

Source 
pub fn verify(token_bytes: &[u8], verifier: &Verifier) -> ActResult<ActClaims>
Expand description

Verifies an encoded ACT and returns its claims.

The order matters. Signature verification precedes every claim check, so a forged token is rejected before any of its unauthenticated content is used to make a decision or shape a log line.

  1. Enforce the size ceiling and decode the envelope.
  2. Verify the Ed25519 signature over the raw claims bytes.
  3. Decode the claims and check they are structurally sound.
  4. Check the temporal window, issuer, audience, and required scopes.

§Errors

Returns the ActError variant describing the first failed step.

§Examples

use agent_capability_token::{verify, ActError, Verifier};

let verifier = Verifier::new(vec![[0u8; 32]], "arsenal:broker:prod-1", "omerta")?;
// An empty payload is not a valid envelope.
assert!(matches!(verify(&[], &verifier), Err(ActError::EnvelopeDecode(_))));