#[non_exhaustive]pub enum ProofPolicy<'a, V>where
V: ProofVerifier + ?Sized,{
Verify(&'a V),
RejectIfPresent,
AcceptUnverified,
}Expand description
How consume_inbound handles a document’s proof member, per
SPEC.md §7.2 item 7.
consume_inbound does not assume what kind of integrity guarantees
the consumer relies on. Some deployments verify Data Integrity proofs
in-band; some have transport-layer integrity (signed DIDComm, mTLS-
bound HTTPS) and accept in-band proofs only opportunistically; some
have no integrity guarantees at all. The variants below make that
decision explicit at the call site.
Payload::IS_PROOF_REQUIRED is consulted independently of the
policy: a spec that requires a proof rejects a proofless document
regardless of which policy was chosen.
Variants (Non-exhaustive)§
This enum is marked as non-exhaustive
Verify(&'a V)
Verify the proof when present using V. When doc.proof is
Some, the verifier is consulted and failures map to
proof_invalid. This is the safe default for any consumer that
expects to honour in-band proofs.
RejectIfPresent
Reject documents that carry an in-band proof with
malformed_request. Use this when the consumer has integrity
guarantees from another layer (e.g. transport-bound signing) and
is deliberately not verifying in-band proofs — silently dropping
a producer-supplied proof would mislead the producer about the
guarantees of the exchange, so the framework rejects the document
instead.
AcceptUnverified
SECURITY: accept any document, with or without a proof, without verifying. Use only when the transport already provides equivalent integrity end-to-end (or the consumer has accepted the policy decision not to honour in-band proofs from this counterparty). This is the explicit opt-out — the variant name is deliberately uncomfortable to type.