BoundedAuthorityProtocol.ApplicationProfile.LocalLoopbackHttp.V1 (Bounded Authority Protocol v1.0.0)

Copy Markdown View Source

Explicit entry point for the byte-distinct local-loopback HTTP application proof profile.

Summary

Producers

assemble_compact(signing_input, signature)

Assembles a local-loopback proof at profile maxima.

assemble_compact(signing_input, signature, limits)

Assembles a local-loopback proof under caller bounds.

normalize_uri(uri, limits)

Normalizes one bounded local-loopback HTTP target URI without DNS or network access.

proof_signing_input(proof, limits)

Builds the deterministic byte-distinct local-loopback proof signing input.

Decoders

decode_proof(compact, limits)

Boundedly decodes a local-loopback proof without evaluating trust.

Verifiers

check_envelope(credentials, expected_request)

Verifies a raw grant and local-loopback proof against server-derived context.

Producers

assemble_compact(signing_input, signature)

@spec assemble_compact(BoundedAuthorityProtocol.V1.SigningInput.t(), binary()) ::
  {:ok, binary()} | {:error, :invalid}

Assembles a local-loopback proof at profile maxima.

assemble_compact(signing_input, signature, limits)

@spec assemble_compact(
  BoundedAuthorityProtocol.V1.SigningInput.t(),
  binary(),
  BoundedAuthorityProtocol.V1.Bounds.t() | map()
) :: {:ok, binary()} | {:error, :invalid}

Assembles a local-loopback proof under caller bounds.

Since 0.9.0, assembly also refuses, with {:error, :invalid}, a signature that no conforming signer emits: an Ed25519 signature whose S is not below the group order or whose R is non-canonical or of small order (erratum 3). It never rewrites the signature bytes it accepts.

normalize_uri(uri, limits)

@spec normalize_uri(binary(), BoundedAuthorityProtocol.V1.Bounds.t() | map()) ::
  {:ok, binary()} | {:error, :invalid}

Normalizes one bounded local-loopback HTTP target URI without DNS or network access.

proof_signing_input(proof, limits)

@spec proof_signing_input(
  BoundedAuthorityProtocol.V1.Proof.t(),
  BoundedAuthorityProtocol.V1.Bounds.t() | map()
) :: {:ok, BoundedAuthorityProtocol.V1.SigningInput.t()} | {:error, :invalid}

Builds the deterministic byte-distinct local-loopback proof signing input.

Decoders

decode_proof(compact, limits)

@spec decode_proof(binary(), BoundedAuthorityProtocol.V1.Bounds.t() | map()) ::
  {:ok, BoundedAuthorityProtocol.V1.DecodedProof.t()} | {:error, :invalid}

Boundedly decodes a local-loopback proof without evaluating trust.

Verifiers

check_envelope(credentials, expected_request)

@spec check_envelope(
  BoundedAuthorityProtocol.V1.Credentials.t(),
  BoundedAuthorityProtocol.V1.ExpectedRequest.t()
) :: {:ok, BoundedAuthorityProtocol.V1.EnvelopeFacts.t()} | {:error, :invalid}

Verifies a raw grant and local-loopback proof against server-derived context.