structured_ltv/pki/
reading.rs

1//! Original CRL processing facts, including outcomes that cannot mint absence.
2
3use super::{CheckedPath, CrlAuthorities, CrlBindingError, CrlBindingFailure};
4use structured_asn1::memory::Work;
5use structured_pkix::{
6    Certificate,
7    crl::{CompleteFacts, DeltaFacts, EvidenceSource},
8    temporal::{LeapTable, Reading},
9};
10
11/// Actual common processing output, without substituting a qualified absence
12/// for an unsuitable window, revoked entry or conflicting source demands.
13#[derive(Clone, Copy)]
14pub enum CrlReading<'view, 'certificate, 'document> {
15    /// Original applicable complete-list facts.
16    Complete(&'view CompleteFacts<'view, 'certificate, 'document>),
17    /// Original applicable metadata-bound complete/delta facts.
18    Delta(&'view DeltaFacts<'view, 'certificate, 'document>),
19}
20
21impl<'certificate, 'document> CrlReading<'_, 'certificate, 'document> {
22    /// Same actual evaluated target; the caller cannot relabel the result.
23    #[must_use]
24    pub fn target(self) -> &'certificate Certificate<'document> {
25        match self {
26            Self::Complete(value) => value.target(),
27            Self::Delta(value) => value.target(),
28        }
29    }
30    /// Exact original evaluation label, including fractional precision.
31    #[must_use]
32    pub fn evaluated_at(self) -> Reading {
33        match self {
34            Self::Complete(value) => value.evaluated_at(),
35            Self::Delta(value) => value.evaluated_at(),
36        }
37    }
38    /// Original authenticated sources. This does not establish usable absence;
39    /// the actual entry, freshness and reason facts remain in this reading.
40    #[must_use]
41    pub fn source(self) -> EvidenceSource<'certificate, 'document> {
42        match self {
43            Self::Complete(value) => EvidenceSource::Complete(*value.source()),
44            Self::Delta(value) => EvidenceSource::Delta {
45                base: *value.pair().base(),
46                delta: *value.pair().delta(),
47            },
48        }
49    }
50}
51
52/// Same original CRL result and each actual signing authority bound to a
53/// checked path member. No absence/Good/status acceptance is manufactured.
54pub struct CrlReadingTarget<'view, 'certificate, 'document> {
55    path: &'view CheckedPath<'document>,
56    member: usize,
57    reading: CrlReading<'view, 'certificate, 'document>,
58    authorities: CrlAuthorities<'view, 'document>,
59}
60
61impl<'view, 'certificate, 'document> CrlReadingTarget<'view, 'certificate, 'document> {
62    /// Same original checked target path.
63    #[must_use]
64    pub fn path(&self) -> &'view CheckedPath<'document> {
65        self.path
66    }
67    /// Exact non-anchor target ordinal.
68    #[must_use]
69    pub fn member(&self) -> usize {
70        self.member
71    }
72    /// Original complete/delta facts, including every negative outcome.
73    #[must_use]
74    pub fn reading(&self) -> CrlReading<'view, 'certificate, 'document> {
75        self.reading
76    }
77    /// Actual authority for every original complete/delta source.
78    #[must_use]
79    pub fn authorities(&self) -> CrlAuthorities<'view, 'document> {
80        self.authorities
81    }
82}
83
84/// Completed source association or original target/key/root/time mismatch.
85pub enum CrlReadingBinding<'view, 'certificate, 'document> {
86    /// All source authorities and the original target are associated.
87    Bound(CrlReadingTarget<'view, 'certificate, 'document>),
88    /// No partial or relabelled result is returned.
89    Rejected(CrlBindingFailure),
90}
91
92impl<'document> CheckedPath<'document> {
93    /// Bind actual CRL facts using the same authority kernel as qualified
94    /// absence. Unsuitable freshness/entries remain readable negative facts;
95    /// only the common facts' separate `absence` method can qualify absence.
96    pub fn bind_crl_reading<'view, 'certificate, W: Work>(
97        &'view self,
98        member: usize,
99        reading: CrlReading<'view, 'certificate, 'document>,
100        authorities: CrlAuthorities<'view, 'document>,
101        utc: &LeapTable<'_>,
102        execution: &W,
103    ) -> Result<CrlReadingBinding<'view, 'certificate, 'document>, CrlBindingError> {
104        if let Some(cause) = self.bind_crl_source(
105            member,
106            super::crl::CrlSource::Reading(reading),
107            authorities,
108            utc,
109            execution,
110        )? {
111            return Ok(CrlReadingBinding::Rejected(cause));
112        }
113        Ok(CrlReadingBinding::Bound(CrlReadingTarget {
114            path: self,
115            member,
116            reading,
117            authorities,
118        }))
119    }
120}
structured_ltv/pki/reading.rs

structured_ltv/pki/
reading.rs
