Struct MandateChain 

pub struct MandateChain {
    pub intent: Vec<u8>,
    pub cart: Vec<u8>,
    pub payment: Vec<u8>,
}

The three signed, wire-form mandate payloads presented together as one pre-authorization.

Fields

intent: Vec<u8>

Signed Intent mandate payload (sign_intent_mandate output).

cart: Vec<u8>

Signed Cart mandate payload.

payment: Vec<u8>

Signed Payment mandate payload.

Implementations

impl MandateChain

pub fn verify( &self, conversation_id: &str, issuer_public_key: &[u8], persona_signer: Option<PersonaSignerTrust<'_>>, now_unix: u64, ) -> Result<VerifiedMandateChain, MandateError>

Validate the whole chain: every link is bound to conversation_id and one consistent caller, the Payment chains (by mandate_hash) to the Cart and the Cart to the Intent, amounts narrow (never widen) down the chain, currency agrees, the Cart carries a non-empty merchant scope, and no link has expired as of now_unix.

Per-link signer trust is resolved separately for each link rather than against one shared key. The Cart and Payment links ALWAYS verify against issuer_public_key (the platform mandate-issuing key) — narrowing a human’s authorization down to a merchant and amount is never something a browser-held key can do on its own, even when the Intent above it is user-signed. The Intent link trusts EITHER issuer_public_key (today’s fully-platform-signed path, unchanged) OR persona_signer — a PersonaSignerTrust proving the persona’s own recorded credential is active and was checked recently enough, passed as Some only when the persona has such a credential on record — whichever one actually signed it. This function itself re-checks that trust itself (revocation and freshness), not merely the caller’s say-so. An Intent signed by neither trusted key is untrusted. Passing None, or Some evidence that is revoked or stale, reduces to exactly today’s behavior: this feature is additive and never a hard requirement.

Errors

One MandateError per broken invariant — see each variant. Fails closed on everything: malformed payloads, unknown signers, chain breaks, widened or unparseable amounts, scope/currency drift, expiry.

Trait Implementations

impl Clone for MandateChain

fn clone(&self) -> MandateChain

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MandateChain

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for MandateChain

fn default() -> MandateChain

Returns the “default value” for a type.