Expand description
Relying-party AC processing over authenticated issuance and original evidence.
The protocol supplies authenticated participants and selected trust. This module binds those inputs, enforces all known critical effects and records usable attribute types. It does not authenticate a protocol, discover trust, decrypt attributes, select freshness policy or grant application permission. RFC5755 §§5–7: https://www.rfc-editor.org/rfc/rfc5755#section-5
Structs§
- Attribute
Use - One original attribute’s AA-control result. Excluded attributes must be ignored for authorization, without suppressing unrelated permitted types.
- Checked
- Completed mechanism facts relative to the caller’s authenticated context. Original issuance/holder/status references remain required; only the new eligibility catalogue is independently owned. This is not an application authorization grant or proof that opaque callback/backend costs are bounded.
- Context
- All operation facts. No configuration discovery, clock, default status or fallback holder method is inferred. Additional OCSP age/nonce/recipient and responder-trust policy belongs to the caller before supplying evidence.
- Holder
Path - One supplied holder PKC path, checked against its explicitly chosen anchor. Protocol proof of possession and PKC revocation remain caller obligations.
- NoStatus
- No external status source. This only completes the never-revoke scheme when that extension was actually accepted in the authenticated original profile.
- Proxy
- Authenticated protocol identities for all proxy participants. The caller
supplies the trustworthy complete preceding-hop list, never an untrusted
list from the AC. A missing context cannot bypass a present
ProxyInfo.
Enums§
- Authority
- Issuance and trust sources retained without cloning profile/path storage.
- Failure
- A completed negative or unproven use requirement. No variant is a resource or callback failure; those remain terminal errors.
- Group
Role - Trusted group-membership query role, with the original target callback error.
- Holder
- Explicit caller-authenticated holder context. Selecting an alternative never tries another written Holder identity as a fallback. Supplying this input asserts that the protocol established the holder’s possession/identity and, for a certificate, its revocation status. The library checks the PKIX path.
- Holder
Error - Located processing and independent holder-path callback causes.
- Holder
Validation - The complete holder-path operation, without a usable partial key.
- Outcome
- Complete use outcome. Only Checked retains a usable attribute catalogue.
- Status
- Status facts for this exact AC and evaluation label. This enum does not accept a caller-created Good assertion as input; Evidence is sealed.
- UseError
- Terminal source/current processing failure or original group callback cause.
Traits§
- Evidence
- Original status capability implemented only by existing shared evidence and
NoStatus. It performs association/summary checks, never repeats a signature,CertIDhash, CRL entry census or temporal evaluation. Caller-selected maximum age, unsolicited-nonce policy and configured responder trust remain external.
Functions§
- direct
- Complete processing using an explicitly selected directly trusted AA. Equal bytes from another untrusted object do not silently select trust.
- issued
- Complete processing under one existing constrained, authenticated AA path. Path and issuance signatures are not repeated by this composition.
Type Aliases§
- Holder
Result - Complete holder path result, retaining verifier and recognizer causes.