Struct StatusListCredential 

pub struct StatusListCredential {
    pub context: Vec<Value>,
    pub id: Option<String>,
    pub type: Vec<String>,
    pub issuer: Value,
    pub valid_from: Option<String>,
    pub credential_subject: StatusListSubject,
    pub proof: Value,
}

A status list credential fetched from the notary’s own origin (spec §6.3.3.3).

Deliberately NOT deny_unknown_fields, for the same reason crate::discovery::did_document::DidDocument is not: this is a general W3C artifact that legitimately carries more than APH reads (name, description, ttl, validUntil, renderMethod). Rejecting those would make APH unable to consume ordinary status list credentials. The ENVELOPE’s own CredentialStatusEntry is strict, because that one is APH’s wire shape and is covered by a signature.

Fields

context: Vec<Value>

JSON-LD contexts the document declares.

id: Option<String>

The credential’s own identifier, when it carries one.

type: Vec<String>

JSON-LD type array; MUST include STATUS_LIST_CREDENTIAL_TYPE.

issuer: Value

The issuing notary. W3C permits a bare DID string or an object with an id, so both are kept verbatim and read through Self::issuer_did.

valid_from: Option<String>

RFC 3339 issuance instant. The freshness bound of §6.3.3.3 is measured from this, so a document without it cannot be accepted.

credential_subject: StatusListSubject

The subject carrying the purpose and the bitstring.

proof: Value

The notary’s proof over this document. Kept verbatim: this module does not verify it (see the module preamble), it only surfaces the verification method the caller must resolve.

Implementations

impl StatusListCredential

pub fn issuer_did(&self) -> Option<&str>

The issuing DID, whether issuer is a string or an object with an id — both are W3C-legal and a verifier that read only one form would refuse conformant notaries.

pub fn proof_verification_method(&self) -> Option<&str>

The proof.verificationMethod the caller must resolve through §8.4 to check this document’s signature — the step named in the module preamble as NOT performed here.

None when the document carries no proof or no method, which the caller MUST treat as §6.3.3.4 case 2 rather than as “nothing to check”.

pub fn validate( &self, notary_did: &str, now_rfc3339: &str, ) -> Result<(), AphError>

Applies every §6.3.3.3 check this crate can make without a key: the credential type, the issuer binding, the purpose, and the freshness bound.

notary_did is the DID the endpoint was DERIVED from (§6.3.3.2 step 1), never a value read out of the document — same-origin alone does not make a document authoritative, because one host serves many documents.

Errors

APH_E008 for every failure, per §6.3.3.4 case 2’s single-code rule: the verifier’s action (reject) and the operator’s remediation (repair the notary’s status surface) are identical for all of them.

pub fn check_freshness(&self, now_rfc3339: &str) -> Result<(), AphError>

The §6.3.3.3 freshness bound, split out so it can be pinned on its own.

Fails CLOSED in every direction: a missing or unparseable validFrom, an unparseable now, a credential older than STATUS_MAX_AGE_SECONDS plus the skew allowance, and a credential dated further into the future than the skew allowance all refuse. A future-dated document is refused because the alternative is a notary (or an attacker who reached its publishing pipeline) buying unbounded staleness by writing tomorrow’s date.

pub fn seconds_until_republish_due( &self, now_rfc3339: &str, ) -> Result<i64, AphError>

Seconds remaining before this document must have been REPLACED by a freshly issued one, per STATUS_REPUBLISH_INTERVAL_SECONDS. Negative once the producer is late.

This is the PUBLISHER’s line, and it is the one worth alarming on. A publication pipeline that stops fails closed — correct, and silent: the first symptom is a stranger’s verifier refusing an envelope, which is the far end of the outage to learn at. The deadline is exposed as a distance rather than as a verdict so an operator can watch it approach instead of discovering it has passed.

Errors

APH_E008 for the same timestamp failures Self::check_freshness refuses on — a missing or unparseable validFrom, or an unparseable now. A distance is not reported from a clock that could not be read, because a monitor would display it as time remaining.

pub fn seconds_until_stale(&self, now_rfc3339: &str) -> Result<i64, AphError>

Seconds remaining before a conformant verifier begins REFUSING this document under §6.3.3.3’s freshness bound. Negative once they do.

The same bound Self::check_freshness applies, read as a distance rather than as a verdict — the outage line, where Self::seconds_until_republish_due is the alarm line.

Errors

APH_E008, on the same inputs and for the same reason as Self::seconds_until_republish_due.

Trait Implementations

impl Clone for StatusListCredential

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for StatusListCredential

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for StatusListCredential

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for StatusListCredential

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.