Issue-time validation: well-formed windows, bounded JSON depth, and _for grant constructors (0.10.0)

[stormer78]

Summary

Four commits. No function signatures change, and nothing changes on the wire for a well-formed credential. The release is 0.10.0 because DTGCredentialError becomes #[non_exhaustive] and two constructors are deprecated (see Compatibility).

1. fix: refuse a validity window that closes before it opens
   • New DTGCredentialError::InvalidValidityWindow { valid_from, valid_until }.
   • create::check_window runs first in new_vac, new_vdc, new_member_vmc(_for), new_delegate_vdc(_for), attenuate_inner and redelegate_inner. It refuses valid_until <= valid_from, compared at whole seconds because that is the wire precision.
   • New DTGCredential::validate(), called at the top of sign().
   • Backdated validFrom stays legal.
2. fix: bound the depth of open JSON before digesting or signing
   • New pub const MAX_JSON_DEPTH: usize = 64, counted from the top of the document, and DTGCredentialError::JsonTooDeep { max }.
   • The check is an iterative walk with an explicit stack.
   • It is enforced in:
     • digest_multibase_json and digest_json, before proofless clones;
     • attenuate_from_json and redelegate_from_json, before a member is cloned out of the parent;
     • DTGCredential::digest_multibase and digest, on endorsement, card, credentialStatus and extra, before the credential is cloned;
     • validate(), which both sign() and verify_proof_with_public_key() now call. This covers with_credential_status / set_credential_status.
   • # Security docs added on new_vec and with_credential_status.
3. feat: take the expected party when answering a grant; verify a grant's proof

   • DTGCredential::new_member_vmc_for(grant, member, valid_from, valid_until) and DTGCredential::new_delegate_vdc_for(grant, delegate, valid_from, valid_until).

     • They return NotTheGrantSubject { expected, found } when credentialSubject.id is not the given party.
     • They return OutlivesGrant { valid_until, grant_valid_until } when the answer ends after the grant, or has no end against a grant that expires.
     • A grant validUntil that is present but unreadable is refused.

   • new_member_vmc and new_delegate_vdc are now #[deprecated(since = "0.10.0")], pointing at the _for forms. Apart from the window check in commit 1, their behaviour is unchanged.

   • verify_grant_with_public_key(grant, public_key, at) is behind affinidi-signing. It runs these checks in order:

     • depth;
     • proof present (NotSigned);
     • proof verifies over the proofless wire form (DataIntegrity);
     • verification-method DID equals issuer (ProofNotFromIssuer);
     • window is well formed and contains at (InvalidValidityWindow / NotValidAt).

     Missing or unreadable members return MalformedCredential.

   • # Security sections added on acknowledges, accepts and both new constructors.

   • Internal tests, the README samples and examples/data_room.rs now use the new API. The example verifies each grant before answering it.

4. chore(release): 0.10.0
   • DTGCredentialError marked #[non_exhaustive].
   • CHANGELOG entry, version bump, and README "Upgrading" notes (including a row in the breaking-release table).
   • Not published.

Compatibility

• Version 0.10.0.
  • DTGCredentialError is now #[non_exhaustive] and gains seven variants: InvalidValidityWindow, JsonTooDeep, NotTheGrantSubject, OutlivesGrant, ProofNotFromIssuer, NotValidAt and MalformedCredential. An exhaustive match downstream needs a wildcard arm. Future variants will not be breaking.
  • Consumers on dtg-credentials = "0.9" do not pick this up with cargo update; the bump is deliberate. That matters because of the deprecations below.
• Deprecations.
  • new_member_vmc and new_delegate_vdc still compile.
  • Builds with -D warnings will flag their call sites, and that includes clippy --all-targets.
• Stricter behaviour.
  • Inverted or empty windows are now refused by every Result constructor, validate(), sign() and verify_proof_with_public_key().
  • Documents deeper than 64 levels are refused by the digest functions, the _from_json derivations, validate(), sign() and verify_proof_with_public_key().
  • A conforming issuer produces neither, so the README's "verifiers first" ordering still holds.

Callers of the deprecated functions in verifiable-trust-infrastructure

Checked against origin/main 5a6d4923 and not edited here. Both call sites are inside #[cfg(test)] modules:

• vtc-service/src/members/inbound_vmc.rs:398: DTGCredential::new_member_vmc(&grant_wire, valid_from, None) (test module starts at line 371).
• vtc-service/src/routes/relationships.rs:2140: DTGCredential::new_member_vmc(&grant_json, m.joined_at, None) (test module starts at line 1966).

There are no callers of new_delegate_vdc, and VTI does not match on DTGCredentialError variants.

VTI's CI runs cargo clippy --workspace --all-targets -- -D warnings. The change that bumps VTI to 0.10.0 therefore needs to move both call sites to new_member_vmc_for in the same commit.

Tests

161 tests with --all-features, up from 124. 146 with --no-default-features.

• tests/membership_edge.rs (new, 14 tests).
  • A grant naming another subject returns NotTheGrantSubject, and the comparison is exact.
  • An acknowledgement outliving its grant returns OutlivesGrant, whether it ends later or has no end.
  • A grant with no expiry places no bound on the acknowledgement.
  • An unreadable grant expiry is refused.
  • Inverted and equal windows return InvalidValidityWindow.
  • Binding alone does not show that the grant was signed.
  • The deprecated constructor's behaviour is pinned, under #[allow(deprecated)].
  • With affinidi-signing:
    • an unsigned grant returns NotSigned;
    • a signed grant verifies and can then be acknowledged;
    • a grant altered after signing fails;
    • the wrong key fails;
    • a proof whose verification method is not the issuer's returns ProofNotFromIssuer;
    • a grant outside its window returns NotValidAt.
• tests/delegation_chain.rs.
  • Moved to new_delegate_vdc_for.
  • Mirrored cases added: NotTheGrantSubject, OutlivesGrant, and an unsigned grant returning NotSigned (feature-gated).
  • Inverted and equal windows return InvalidValidityWindow for new_vdc, redelegate, redelegate_from_json and the acceptance.
• tests/authority_chain.rs.
  • Inverted and equal windows are refused for new_vac, attenuate and attenuate_from_json.
  • A backdated window is accepted.
  • A window narrower than one second is refused.
• tests/json_bounds.rs (new, 13 tests).
  • Depth MAX_JSON_DEPTH - 3 passes, and exactly at the bound passes; one level over returns JsonTooDeep.
  • Over-deep credentialStatus and extra are refused.
  • Depth 200 returns an error instead of aborting for digest_multibase_json, digest_multibase / validate, attenuate_from_json and redelegate_from_json. These run on a std::thread::Builder thread with a 256 KiB stack.
  • serde_json's parser limit is pinned: 127 levels parse and 128 fail.
  • A credential at the bound parses back.
  • Open members survive a round trip unchanged.
  • With affinidi-signing, sign and verify_proof_with_public_key refuse over-deep members.
• src/lib.rs unit tests.
  • validate() refuses inverted and empty windows and accepts backdated or open-ended ones.
  • new_member_vmc refuses an inverted window.
  • sign() refuses an inverted window and leaves no proof.

Regression check. With the iterative guard temporarily made to always return false, each of the three small-stack tests aborts with thread 'small-stack' has overflowed its stack (SIGABRT). The guard was then restored.

Verification

Run locally on macOS arm64 with the repository's toolchain; results for the final commit are in the PR conversation.

• cargo fmt --all --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features and cargo test --no-default-features
• cargo package --locked
• cargo run --example data_room: the example verifies both grants, then completes the membership and delegation edges.

Open questions

• Is "an acknowledgement or acceptance MUST NOT outlive its grant" normative in Working Draft 02? OutlivesGrant enforces it in the new constructors only.
• MAX_JSON_DEPTH = 64 as proposed. There is no byte-size cap; that is a policy call for the owners.