structured-xades 0.6.1

XAdES mechanisms over caller-owned XML and explicit resource accounting
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126

//! Whole incorporation or one exact earlier archive's original coverage.

use super::{Error, Missing};
use crate::binary::Location;
use crate::material::{ArchiveError, Archived, ArtifactRef, Index};
use crate::timestamp::{ElementCoverage, Role, TimestampRequirements, TimestampScope, Verified};
use crate::xml::{Access, Xml};
use structured_asn1::memory::{HashWork, Memory, Work};

/// Optional original archive coverage; only these constructors expose it.
/// The check verifies its source/role/property against the source-derived scope
/// BEFORE handler calls. A whole-signature check cannot impersonate an archive.
pub struct Scope<'a, N: HashWork, D, G, C: Work = Memory> {
    archive: Option<Archive<'a, N, D, G, C>>,
}

type Archive<'a, N, D, G, C> = (&'a ElementCoverage<N, D, G, C>, &'a Verified<N, D, G>);

impl<N: HashWork, D, G> Scope<'_, N, D, G> {
    /// Whole-signature incorporation, with no archive implication.
    #[must_use]
    pub fn whole() -> Self {
        Self { archive: None }
    }
}

impl<'a, N: HashWork, D, G, C: Work> Scope<'a, N, D, G, C> {
    /// Exact selected archive input and its private mathematical token receipt.
    #[must_use]
    pub fn before_archive(
        coverage: &'a ElementCoverage<N, D, G, C>,
        evidence: &'a Verified<N, D, G>,
    ) -> Self {
        Self {
            archive: Some((coverage, evidence)),
        }
    }
}

impl<N: Copy + Eq + HashWork, D: Copy + Eq, G: Copy + Eq, C: Work> Scope<'_, N, D, G, C> {
    pub(super) fn require<X: Xml<Id = N, Document = D, Generation = G>, W: Work, Q: Work, PE>(
        &self,
        required: &TimestampRequirements<N, D, G>,
        index: &Index<'_, N, D, G, W>,
        access: &Access<'_, X, Q>,
    ) -> Result<(), Error<X::Error, PE, N>> {
        let location = required.scope().location();
        let node = location.node;
        if location.snapshot != access.snapshot() {
            return Err(Error::Foreign { node });
        }
        index
            .require_signature(required.signature(), access)
            .map_err(Error::Index)?;
        match (required.scope(), self.archive) {
            (TimestampScope::All(_), None) => Ok(()),
            (TimestampScope::BeforeArchive(_), Some((coverage, evidence))) => {
                if evidence.role() != Role::Archive
                    || evidence.token().snapshot != location.snapshot
                    || !access
                        .equal_id(evidence.signature(), required.signature())
                        .map_err(|cause| Error::Resource { node, cause })?
                    || !access
                        .equal_id(evidence.property(), node)
                        .map_err(|cause| Error::Resource { node, cause })?
                {
                    return Err(Error::Foreign { node });
                }
                coverage
                    .require_evidence(evidence, node, access)
                    .map_err(|cause| Error::Archive(ArchiveError::Coverage(cause)))
            }
            _ => Err(Error::Foreign { node }),
        }
    }

    pub(super) fn known<X: Xml<Id = N, Document = D, Generation = G>, W: Work, Q: Work, PE>(
        &self,
        need: ArtifactRef<'_, '_>,
        index: &Index<'_, N, D, G, W>,
        access: &Access<'_, X, Q>,
    ) -> Result<Option<Missing>, Error<X::Error, PE, N>> {
        if let Some((coverage, evidence)) = self.archive {
            return index
                .archived(need, coverage, evidence, access)
                .map(|value| match value {
                    Archived::Present(_) => None,
                    Archived::Missing => Some(Missing::Absent),
                    Archived::Uncovered => Some(Missing::Uncovered),
                })
                .map_err(Error::Archive);
        }
        let mut copies = index.artifact(need, access).map_err(Error::Index)?;
        copies
            .next()
            .transpose()
            .map(|value| {
                if value.is_some() {
                    None
                } else {
                    Some(Missing::Absent)
                }
            })
            .map_err(Error::Index)
    }

    pub(super) fn open<X: Xml<Id = N, Document = D, Generation = G>, Q: Work, PE>(
        &self,
        location: Location<N, D, G>,
        access: &Access<'_, X, Q>,
    ) -> Result<Option<Missing>, Error<X::Error, PE, N>> {
        if let Some((coverage, evidence)) = self.archive {
            return coverage
                .covers(evidence, location.node, access)
                .map(|covered| {
                    if covered {
                        None
                    } else {
                        Some(Missing::Uncovered)
                    }
                })
                .map_err(|cause| Error::Archive(ArchiveError::Coverage(cause)));
        }
        Ok(None)
    }
}