mars-server · validation

Package: mars-server · Workspace version: 0.1.0 · Module: validation

This reference follows declared modules and public syntax, including public implementation methods. Function bodies and constant values are omitted. Feature conditions are retained. Private-module re-exports and trait resolution require the compiler; not every declaration is a root import.

validation::resolver

Validation pipeline for MARS registry entries.

Per MARS Specification Section 12.3, the pipeline runs these checks in order:

Schema check — entry.validate() from mars-protocol
DID format check — verify entry_did and publisher_did are valid OAS DIDs.
Hash verification — recompute item_data_hash and compare.
Signature verification — resolve the publisher's Ed25519 public key, apply the canonical MARS-PUBLISHER-SIGNING-V1 profile, and verify the Ed25519 signature. The signing key's controller DID must equal the entry's publisher_did (no impersonation across publishers). For self-signed records (HumanRootRecord and friends), policy may allow the resolver to extract the key from the entry's own item_data.
Sequence check — new entry must have sequence > existing (replay protection).
Bond check — if the entry type requires a bond, verify bond_reference is present and meets the minimum amount.

pub mod resolver;

Source line: 20.

validation::ValidationPipeline

Validation pipeline that runs the MARS-spec validation steps.

Holds an [Arc<dyn PublisherKeyResolver>] so signature verification can resolve publisher keys from a static pin map, the entry store, or a composite resolver. Cloning a pipeline is cheap (Arc bump).

#[derive(Clone)]
pub struct ValidationPipeline {

}

Source line: 59.

validation::ValidationPipeline::new

Create a fail-closed validation pipeline with the given resolver.

Self-signed root bootstrap is disabled. Development or migration tools that intentionally need bootstrap must call [Self::new_with_bootstrap_policy] with an explicit true.

pub fn new(registry_did: &str, key_resolver: Arc<dyn PublisherKeyResolver>) -> Self;

Source line: 88.

validation::ValidationPipeline::new_with_bootstrap_policy

Create a validation pipeline with an explicit root bootstrap policy.

pub fn new_with_bootstrap_policy(
        registry_did: &str,
        key_resolver: Arc<dyn PublisherKeyResolver>,
        allow_self_signed_bootstrap: bool,
    ) -> Self;

Source line: 98.

validation::ValidationPipeline::new_with_components

Construct the pipeline with explicit trust and bond ports.

pub fn new_with_components(
        registry_did: &str,
        key_resolver: Arc<dyn PublisherKeyResolver>,
        bond_port: Arc<dyn BondPort>,
        allow_self_signed_bootstrap: bool,
    ) -> Self;

Source line: 112.

validation::ValidationPipeline::with_static_and_store

Fail-closed layered constructor that tries the supplied static map first and falls back to the store.

Root bootstrap is disabled unless the caller chooses it explicitly via [Self::with_static_and_store_and_bootstrap_policy].

pub fn with_static_and_store(
        registry_did: &str,
        static_keys: StaticKeyResolver,
        store: Arc<dyn EntryStore>,
    ) -> Self;

Source line: 131.

validation::ValidationPipeline::with_static_and_store_and_bootstrap_policy

Build the pinned-first resolver chain with an explicit bootstrap policy.

pub fn with_static_and_store_and_bootstrap_policy(
        registry_did: &str,
        static_keys: StaticKeyResolver,
        store: Arc<dyn EntryStore>,
        allow_self_signed_bootstrap: bool,
    ) -> Self;

Source line: 140.

validation::ValidationPipeline::validate_new_entry

Validate a new entry through the full pipeline.

Runs all spec validation steps (schema, DID format, hash, signature, bond). Does not run the sequence check because this is a brand-new entry.

pub async fn validate_new_entry(
        &self,
        entry: &MarsEntry,
        store: &dyn EntryStore,
    ) -> Result<(), ServerError>;

Source line: 163.

validation::ValidationPipeline::validate_federated_entry

Validate publisher-authored federation content before conflict resolution or import.

Bond availability and registry sequence are local state concerns and are deliberately not treated as substitutes for publisher provenance. The import path verifies structure, OAS identity, item hash, and the controller-bound Ed25519 signature, then applies local anchor and visibility policy separately.

pub async fn validate_federated_entry(
        &self,
        entry: &MarsEntry,
        store: &dyn EntryStore,
    ) -> Result<(), ServerError>;

Source line: 187.

validation::ValidationPipeline::validate_update

Validate an entry update through the full pipeline.

Runs all spec validation steps plus sequence replay protection.

pub async fn validate_update(
        &self,
        entry: &MarsEntry,
        store: &dyn EntryStore,
    ) -> Result<(), ServerError>;

Source line: 204.

validation::ValidationPipeline::resolve_trusted_key

Resolve a trusted Ed25519 key without performing external IO.

pub async fn resolve_trusted_key(
        &self,
        key_id: &str,
    ) -> Result<ed25519_dalek::VerifyingKey, ServerError>;

Source line: 225.

validation::ValidationPipeline::verify_detached_signature

Verify an Ed25519 signature over a detached JCS-canonical payload.

pub async fn verify_detached_signature<T: serde::Serialize + Sync>(
        &self,
        expected_controller: &str,
        payload: &T,
        signature: &mars_protocol::signature::EntrySignature,
    ) -> Result<(), ServerError>;

Source line: 242.

validation::ValidationPipeline::verify_oas_attestation

Verify a canonical OAS Verifiable Credential using only local trust and revocation inputs.

The authenticated principal must equal credential.issuer, the credential subject must equal the target entry, the proof verification method controller must equal that issuer, and the proof must verify against a locally resolved trusted key. Issuance/expiry checks run only after those signature bindings succeed.

pub async fn verify_oas_attestation(
        &self,
        credential: &oas_attestation::credential::OasCredential,
        authenticated_issuer: &str,
        entry_did: &str,
        now: chrono::DateTime<chrono::Utc>,
    ) -> Result<(), ServerError>;

Source line: 272.

Source provenance

Source: mars-server/src/validation/mod.rs · SHA-256 7b4e9292d622b0eaf4dfd166aae0d1aea9e661613f4dad5cdcc73239bdb56bec. Package overview.

mars-server · validation

On this page