Struct Token 

pub struct Token<'a> { /* private fields */ }

Timestamp envelope; reading does not establish signature, trust or chronology.

The original signed message stays borrowed. TSTInfo is read through a scoped callback so BER joins cannot produce dangling borrowed models or require a self-referential owned container. Independently retained results are explicit.

Implementations

impl<'a> Token<'a>

pub fn read(parser: &'a Parser, document: &'a [u8], base: u64) -> Result<Self>

Reads the complete timestamp CMS envelope using the original parser. The attached TSTInfo bytes are inspected by Self::with_info.

pub fn read_from(root: &mut Reader<'a>) -> Result<Self>

Reads a complete token from its original scoped source reader.

Source encoding, offsets, inherited depth, parser session and current operation ceilings are preserved. No replacement parser, retagging or copy is performed. Trailing bytes in this source window are refused.

pub fn from_message( message: SignedData<'a>, parent: &Reader<'a>, ) -> Result<Self>

Applies timestamp envelope rules to an already decoded signed message.

RFC3161 §2.4.2 requires attached TSTInfo and only the TSA signature. Inspection recovery of equal parsed signers is explicitly nonconforming: retain the first original encoding and one ExtraSignature fault. The common narrow comparer ignores BER container spellings, preserves exact signedAttrs and opaque field identity, and never rewrites signed bytes. Conflicting signer values refuse; this is not a trust/provider selector. https://www.rfc-editor.org/rfc/rfc3161#section-2.4.2

pub fn message(&self) -> &SignedData<'a>

Original signed message, including unmodified signed attribute ranges.

pub fn signer(&self) -> &SignerInfo<'a>

The first original TSA signer, after nonempty/unique-reading admission.

pub fn faults(&self) -> &[Error]

Additional envelope diagnostics, separate from CMS and TSTInfo faults.

pub fn with_info<R, E>( &self, parent: &Reader<'_>, callback: impl for<'scope> FnOnce(&TokenInfo<'scope>, &Reader<'scope>, &SourceMap) -> Result<R, E>, ) -> Result<R, ContentError<InfoError<E>>>

Reads the complete attached TSTInfo in a callback with honest provenance.

Owned output/error types cannot borrow temporary joins. Located errors use the provided map’s coordinates; that map is retained with every inner error. The caller chooses verification/trust/request context, and admits explicit independent proof data before leaving the callback. A uniquely readable first value followed by trailing carried bytes is returned with a located TrailingData fault; those bytes are not repaired or parsed as another token. Diagnostic retention can itself refuse resources. Complete checking still rejects the nonconforming information.

pub fn with_info_mapped<R, E>( &self, parent: &Reader<'_>, source: &SourceMap, callback: impl for<'scope> FnOnce(&TokenInfo<'scope>, &Reader<'scope>, &SourceMap) -> Result<R, E>, ) -> Result<R, ContentError<InfoError<E>>>

Inspects a token decoded inside another scoped content source.

The parent map is composed before inspection. Errors retain physical range metadata independently of both joined buffers; the original parser depth and operation budgets still govern the nested reader.

impl Token<'_>

pub fn matches_cert_req( &self, requested: &Request<'_>, selected: Option<&Certificate<'_>>, token_parent: &Reader<'_>, request_parent: &Reader<'_>, ) -> Result<bool, RequestFieldError>

Checks the parsed request’s certReq against this original SignedData.

RFC3161 §2.4.1 requires the signing certificate when TRUE, and absence of the certificates field when FALSE (including the schema default). A present empty field fails FALSE; a different certificate with the same SID fails TRUE. selected must independently be signature/ESS-bound; exact carriage alone establishes neither binding nor certificate trust. https://www.rfc-editor.org/rfc/rfc3161#section-2.4.1

impl<'a> Token<'a>

pub fn check_signature<'check, P: SignatureProvider<'check>>( &'check self, provider: &'check P, key: WorkingKey<'check>, parent: &Reader<'check>, ) -> Result<TokenSignature<'check>, SignatureError<P::Error>>

where 'a: 'check,

Executes the one TSA signer over its original attached TSTInfo octets.

This shares CMS preparation and raw/prehash execution, including exact retagged signedAttrs and its separate message-digest agreement. It never hashes a normalized/re-encoded TSTInfo in place of the signed payload. The key may borrow a shorter-lived caller descriptor and retain inherited parameters. SID/ESS binding, TSA purpose, request/time and trust remain independent checks; Valid alone never creates authenticated evidence. RFC5652 §§5.1, 5.3 allow an empty advertised digest catalogue and make rejection of an unlisted signer algorithm optional. This operation verifies the signer’s actual algorithm; catalogue-based rejection is an application profile decision, not an unconditional CMS syntax rule. https://www.rfc-editor.org/rfc/rfc5652#section-5.3

impl<'doc> Token<'doc>

pub fn check<'a, P, S: Source, PE, RE>( &'a self, provider: &'a P, parent: &Reader<'a>, context: &CheckContext<'a, '_>, covered: &mut S, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, ) -> Result<CheckedTimestamp<'a>, CheckError<S::Error, PE, RE>>

where P: for<'scope> SignatureProvider<'scope, Error = PE>, 'doc: 'a,

Checks original CMS, ESS, TSA, content, request and time together.

Caller path/status/policy and signed ESS restriction enforcement remain external. Semantic negatives remain facts, never evidence. Processing, provider and source refusals abort. Provider errors are source-independent so a temporary joined information buffer cannot escape in their type. Optional rejection of unlisted digest algorithms (RFC5652 §5.3) belongs to caller policy. Evidence does not assert that every sender SHOULD or application-profile requirement was satisfied.

pub fn check_with_profile<'a, P, S: Source, PE, RE, FE>( &'a self, provider: &'a P, parent: &Reader<'a>, context: &CheckContext<'a, '_>, covered: &mut S, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, profile: impl for<'view, 'scope> FnOnce(ProfileInput<'view, 'doc, 'a, 'scope>) -> Result<(), ProfileFailure<FE>>, ) -> Result<CheckedTimestamp<'a>, ProfileCheckError<S::Error, PE, RE, FE>>

where P: for<'scope> SignatureProvider<'scope, Error = PE>, 'doc: 'a,

Checks the same common timestamp once, with a scoped profile inspection before any ESS binding, provider resolution, signature/content execution or extension-recognition callback. Original syntax faults still refuse first. The profile sees original fields, both producing readers and their coordinate contexts; it must fund its own work before execution. Refusal is terminal and cannot borrow a temporary information buffer. The common core does not roll back external side effects of the profile.

pub fn check_mapped<'a, P, S: Source, PE, RE>( &'a self, provider: &'a P, source: (&Reader<'a>, &SourceMap), context: &CheckContext<'a, '_>, covered: &mut S, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, ) -> Result<CheckedTimestamp<'a>, MappedCheckError<S::Error, PE, RE>>

where P: for<'scope> SignatureProvider<'scope, Error = PE>, 'doc: 'a,

Checks a token decoded in another joined source using the same core. The map corresponds to its producing envelope reader. Child TSTInfo maps are composed to physical fragments; outer CMS errors separately retain the envelope map instead of borrowing a temporary joined buffer.

pub fn check_mapped_with_profile<'a, P, S: Source, PE, RE, FE>( &'a self, provider: &'a P, source: (&Reader<'a>, &SourceMap), context: &CheckContext<'a, '_>, covered: &mut S, recognizes: impl FnMut(&TokenExtension<'_>, &Execution<'_>) -> Result<bool, RE>, profile: impl for<'view, 'scope> FnOnce(ProfileInput<'view, 'doc, 'a, 'scope>) -> Result<(), ProfileFailure<FE>>, ) -> Result<CheckedTimestamp<'a>, MappedProfileCheckError<S::Error, PE, RE, FE>>

where P: for<'scope> SignatureProvider<'scope, Error = PE>, 'doc: 'a,

Same profile/core kernel for a logically joined CMS envelope. Both independent maps survive refusal; an outer profile location must use the envelope map rather than the inner information map. Reader/session misuse is refused before map admission or profile/provider dispatch.

Trait Implementations

impl<'a> Debug for Token<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.