pub struct ValidatedPath<'p, 'a> { /* private fields */ }Expand description
A caller-selected AA CA, its authenticated path, effective AA key and controls.
The last supplied certificate is explicitly trusted as the AA CA and is not part of the RFC5280 prospective path. This capability establishes neither revocation status nor application authorization, holder proof, or targeting. Policy storage and control catalogues retain their accounts after the query.
Implementations§
Source§impl<'p, 'a> ValidatedPath<'p, 'a>
impl<'p, 'a> ValidatedPath<'p, 'a>
Sourcepub fn certificates(&self) -> &[&Certificate<'a>]
pub fn certificates(&self) -> &[&Certificate<'a>]
Original leaf-first certificates, including the explicitly trusted AA CA.
Sourcepub fn anchor(&self) -> EffectiveAnchor<'a>
pub fn anchor(&self) -> EffectiveAnchor<'a>
Selected AA CA and its bound effective key, without root re-verification.
Sourcepub fn facts(&self) -> &ValidationFacts<'a>
pub fn facts(&self) -> &ValidationFacts<'a>
Completed static PKIX facts, including the actual AA effective key.
Sourcepub fn interval(&self) -> Interval
pub fn interval(&self) -> Interval
The same complete interval used by path and later AC authentication.
Sourcepub fn allows<W: Work>(&self, kind: Oid<'_>, work: &W) -> Result<Permission>
pub fn allows<W: Work>(&self, kind: Oid<'_>, work: &W) -> Result<Permission>
Intersect every control, including for decrypted types and encAttrs. The caller owns attribute decryption and application permission decisions.
Sourcepub fn authenticate<'r, 'c, V, W: Work>(
&'r self,
certificate: &'r AttributeCertificate<'c>,
verifier: &V,
work: &W,
) -> Result<Outcome<Issued<'r, 'p, 'c, 'a>>, AuthenticationError<<V as AlgorithmAgreement>::Error>>where
for<'op> V: AlgorithmAgreement + Verify<Execution<'op>, Error = <V as AlgorithmAgreement>::Error>,
pub fn authenticate<'r, 'c, V, W: Work>(
&'r self,
certificate: &'r AttributeCertificate<'c>,
verifier: &V,
work: &W,
) -> Result<Outcome<Issued<'r, 'p, 'c, 'a>>, AuthenticationError<<V as AlgorithmAgreement>::Error>>where
for<'op> V: AlgorithmAgreement + Verify<Execution<'op>, Error = <V as AlgorithmAgreement>::Error>,
Authenticate an AC with this path’s AA key and interval, without repeating any path signature. The supplied verifier enforces its selected algorithm policy and accounts its backend; no engine is selected by this module. Holder proof, status, target/proxy effects and authorization remain separate.