Module aa_path 

RFC5755 §7.4 restrictions along one explicitly supplied AA certificate path.

AaPath::read collects restrictions from an already authenticated leaf-first path. validate combines that same census with the common PKIX validator and a separately selected trusted AA CA. Its returned ValidatedPath can authenticate AC issuance without repeating path signatures. Trust selection, revocation and application authorization remain caller obligations. https://www.rfc-editor.org/rfc/rfc5755#section-7.4

Structs

AaPath

Complete restriction census from the AA issuer through the chosen AA CA.

Issued

Original AC issuance authenticated under one checked AA-CA path. This is not an authorization grant or proof that other AC obligations passed.

ValidatedPath

A caller-selected AA CA, its authenticated path, effective AA key and controls.

Enums

PathCheck

Completed AA path result. No rejected or incomplete path carries a usable key.

PathError

Execution failures keep their original processing or callback cause.

Permission

Completed per-attribute intersection, not an application permission verdict.

Functions

validate

Validate one full AA path ending in a caller-selected, directly trusted AA CA.

validate_with_key

The same complete operation with an effective key supplied for the selected AA CA. Original inherited parameters are retained; a key from another SPKI refuses before control decoding or any verification callback.

Type Aliases

PathResult

Complete AA-path operation result with independent verifier/recognizer errors.