pub fn validate_attachment_hash(hash: &str) -> DataResult<()>Expand description
Check that a string is a well-formed attachment address.
The hash is checked for shape, not for reachability: whether anybody still holds the bytes is not knowable here, and a reference to a blob nobody has is a normal, recoverable state. What is not recoverable is a hash that is not a hash, because no fetch can ever succeed and the reference replicates to the whole space regardless.
Case matters. The hash is an address, and two spellings of one address are two addresses: they would fetch twice, store twice, and compare unequal while naming identical bytes. Lowercase is the canonical form, and the uppercase spelling is refused rather than folded so that a writer producing the wrong one hears about it.
Separate from validate_attachment because a hash also travels alone:
the frames that ask for a blob and refuse one carry nothing else. Checking
those through the whole-reference validator means inventing a size to
satisfy it, which ties a frame check to a bound that has nothing to do
with it and breaks the day that validator gains a cross-field rule.