Struct VerificationPolicy 

pub struct VerificationPolicy {
    pub required_components: Vec<Component>,
    pub required_tag: Option<String>,
    pub max_age: u64,
    pub clock_skew: u64,
    pub require_nonce: bool,
}

Available on crate feature integrity only.

Required coverage and freshness for an application of RFC 9421.

Verification uses an explicit validation instant, normally message receipt, so long-running response streams need not finish within the validity window. Nonce checks here validate its format; applications must atomically reject reused nonces after authenticating the signature and the complete body.

Fields

required_components: Vec<Component>

Components that must be covered, including their exact parameter sets.

"content-digest" requires header coverage; "content-digest";tr requires trailer coverage. Listing both requires both, not either one. To let a response choose its digest location, omit its digest from this list and use crate::body::VerifyingBody with a verifier. That adapter independently requires a matching SHA-256 digest and signature coverage of its actual section. Verifier::verify alone does not check the body.

Examples

use alloc::vec;
use asimov_http::{Component, VerificationPolicy};

// With VerifyingBody, accept the response digest in either section.
let either = VerificationPolicy::new(vec![
    Component::new("@status")?,
    Component::new("content-type")?,
]);

// Require header coverage; a trailer-only digest cannot satisfy this.
let mut in_headers = either.clone();
in_headers.required_components.push(Component::new("content-digest")?);

// Or require trailer coverage instead. Choose one policy per verifier.
let mut in_trailers = either;
in_trailers
    .required_components
    .push(Component::trailer("content-digest")?);

required_tag: Option<String>

Required application tag, when set.

max_age: u64

Maximum age and advertised lifetime in seconds. Defaults to 60.

clock_skew: u64

Permitted clock skew in seconds. Defaults to 30.

require_nonce: bool

Require a standard-Base64 nonce containing at least 128 bits.

Implementations

impl VerificationPolicy

pub fn request() -> Self

The ASIMOV remote request profile: method, absolute target URI, bearer credential, Accept, content type, and SHA-256 content digest coverage.

pub fn new(required_components: Vec<Component>) -> Self

Creates a policy with explicit coverage, a 60-second lifetime, 30-second tolerance, and a required nonce. Creation and expiry are always required.

Trait Implementations

impl Clone for VerificationPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for VerificationPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.