Struct PasskeyCapabilityVerifier 

pub struct PasskeyCapabilityVerifier { /* private fields */ }

Kernel-side verifier for PasskeyCapability envelopes.

The verifier is configured with the audience the kernel pins itself to, and the issuer’s public key (the public half of the chio_core_types::crypto::SigningBackend the issuer used to sign the capability). The verifier is Send + Sync and stateless; production deployments hold one in an Arc<> and re-use it across every kernel call.

Implementations

impl PasskeyCapabilityVerifier

pub fn new(audience: impl Into<String>, issuer_public_key: PublicKey) -> Self

Build a verifier pinned to a kernel audience and the issuer public key.

pub fn audience(&self) -> &str

Configured kernel audience pin.

pub fn issuer_public_key(&self) -> &PublicKey

Configured issuer public key.

pub fn verify( &self, capability: &PasskeyCapability, now: DateTime<Utc>, ) -> Result<(), CustodyError>

Verify a PasskeyCapability presented to this kernel.

Returns Ok(()) only when ALL four gates pass:

1. capability.signature is non-empty.
2. capability.audience == self.audience.
3. now < capability.exp.
4. The detached hex-encoded capability.signature verifies under Self::issuer_public_key over the canonical-JSON bytes of the envelope WITH signature = "" (the same message the issuer signed).

Fail-closed: any failing gate returns a typed CustodyError. The first failing gate short-circuits; deployments that need distinct telemetry per gate read the CustodyError::urn.